EP0645028A1 - Secure front end communication system and method for process control computers - Google Patents

Abstract

A secure front-end communication system which couples a plurality of actively redundant process control computers to a computer network. The system includes a front end computer which is capable of establishing time limited communication contracts with one or more computer entity on the computer network. Each time limited communication contract is based upon an acceptable response to the transmission of an unpredicable signal from the front end computer, such as an encrypted transformation of a pseudo-random number generated by the front end computer. A security table is used to identify the network entities that are permitted to send write command messages to the process control computers to which the front end computer is connected. The front end computer also includes at least one permissive table which is used to determine whether a write command message from the network entity should be transmitted to the process control computer for which the message was intended.

Description

SECURE FRONT END COMMUNICATION SYSTEM AND METHOD FOR PROCESS CONTROL COMPUTERS

BACKGROUND OF THE INVENTION

The present invention generally relates to "front-end" communication techniques between process control computers and a plant/local area network. or'- specifically, the present invention relates to a front-end communication system which is capable of securely handling messages from the plant area network which could affect the

¹ - operation of a process control computer.

In chemical manufacturing plants and other relatively large processing plants, a network of control computers and operator workstations may be needed to achieve automated control of an ongoing physical process in the plant. For example, the Jones et. al U.S. Patent No. 4,663,704, issued on May 5, 1987, shows a distributed processing system for a

¹ 5 plant in which a single data hignway connects all the various input/output terminals, data acquisition stations, control devices, record keeping devices and so forth. Similarly, the Henzel U.S. Patent No. 4,607,256, issued on August 19, 1986, shows a plant management system which utilizes a plant control bus for the purpose of transmitting data to physical computer modules on the network.

^^u In some of these process control computer networks, redundant process control computers are employed to enhance the reliability of the plant control and monitoring system. For example, the Fiebig et. al U.S. Patent No. 5,008,805, issued on April 16, 1991 , shows a networked control system which includes a "hot standby" redundant processor that synchronously processes a control schedule table for comparison with control messages from a

²5 sender processor that are transmitted on the network. The redundant listener processor maintains a duplicate configuration in its memory ready to take over control of the system in the event of a failure of the sender processor. As another example, the McLaughlin et. ai U.S. Patent No. 4,958,270, issued on September 18, 1990, shows a networked control system which employs a primary controller and a secondary controller. In order to maintain consistency

^3u between the primary data base and a secondary image of the data base, only predetermined areas changed are updated as a way of increasing the efficiency of the update f unction. Similarly, the Slater U .S. Patent No. 4,872, 106, issued on October 3, 1989, shows a networked control system which employs a primary data processor and a back- up data processor. Normally, the back-up processor will be in a back-up mode of operation, and it will not operate

35 to exercise control over the input/output devices or receive data concerning the states of the input/output devices. Accordingly, control over the input/output devices is exclusively carried out by the primary processor. However, the primary processor periodically transfers status data relating to its operation in tne control of the inDut/outDut devices to tne oac -uD αata processor via a αual porteα memory connected between the two processors.

In contrast with the above networked control systems, another control technique for reαundant process control comouters exists in wnich both of the Drocess control computers operate on input data and issue control commands to the same output devices. This type of control technique may be referred to as active redundancy, because each of the redundant process control computers operate independently and concurrently on common input data. A discussion of this type of control technique may be found in the Glaser et. al U.S. Patent Application Serial No. 07/864,931 , filed on March 31 , 1991 , entitled "Process Control Interface System Having Triply Redundant Remote Field Units" . This application is hereby incorporated by reference.

The use of active redundancy as a control technique presents a difficult problem in terms of communication with the plant computer network, as each actively redundant process control computer will receive a set of input values and each of these process control computers will generate a set of output values. In the case where the actively redundant process control computers arbitrate or resolve some or all of the input and/or output values, to the extent that differences do exist, then multiple sets of input and output values could be created. For example, a set of pre-arbitration and post-arbitration input data values could potentially be available from each of the actively redundant process control computers. Accordingly, it would be desirable to enable some or all of these data sets to be matched up and analyzed by another computer on the plant network without interfering with or slowing down the operation of the actively redundant process control computers.

Additionally, it would be desirable to permit one or more of the computers on the plant network to modify certain values used by the program in each of the actively redundant process computers as the need may arise, such as analog constants. However, it should be appreciated that such an activity would need to be restricted in some manner, as predictable changes in the operation of physical devices should be assured.

Accordingly, it is a principal objective of the present invention to provide a secure front-end communication system and method for controlling signals transfers between an actively redundant process control computer and a plant/local area network.

It is another objective of the present invention to provide a secure front-end communication system which is capable of evaluating an instruction from the plant/local that could affect the operation of the actively redundant process control computer.

It is also an objective of the present invention to provide a secure front-end communication system which insures that there is proper alignment with the operating program in the actively redundant process control computers.

It is a further objective of the present invention to provide a secure front-end communication system which enables one of the actively redundant process control computers o receive a reviseα operating program without adversely affectly the operation of the other actively redundant process control computer it is an additional objective of the present invention to provide a secure front-end communication system and method which is capable of utilizing a plurality of different communication protocols and encryption techniques depending upon the type of message being transmitted

SUMMARY OF THE INVENTION

To achieve the foregoing oojectives, the present invention provides a secure front-end communication system wnicn is interposed between a plurality of actively redundant orocess control computers and a computer network. The secure front-end communication system includes a front end computer which is capable of establishing time limited communication contracts with one or more computer entity on the computer network. In accordance with the method of the present invention, each of these time limited communication contracts is based upon an acceptable response to the transmission of an unpreoicable signal from the front enα computer. More particularly, the acceptable response is preferably in the form of an encrypted transformation of a psuedo-random number generated by the front end computer. Additionally, before the time limited communication contract expires, the front end computer will negotiate a new time limited communication contract with the computer entity on the computer network using a new psuedo-random number. In one form of the present invention, the front end computer also includes at least one permissive table which is used to determined whether a write command message from the network entity should be transmitted to the process control computer for which the message was intended. A security server is also included on the computer network for transmitting a security table to the front end computer. The security table is used to identify the network entities that are permitted to send write command messages to the process control computers to which the front end computer is connected.

Additional features and advantages of the present invention will become more fully apparent from a reading of the detailed description of the preferred embodiment and the accompanying drawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a block diagram of an intelligent front-end communication system for a plurality of actively redundant process control computers which utilizes a stealth interface according to the oresent invention

Figures 2A and 2B provide a diagrammatic representation of the data tables stored in a time aligned reflective memory buffer and the Correlate buffer shown in Figure 1.

Figure 3 is a block diagram of the stealth interface shown in Figure 1 F'gures 4A and 4B comprise a schematic diagram of the stealth interface of Figures 1 and 2

Figures 5A and 5B illustrate two timing diagrams for the stealth interface

Figures 6A-6E comprise a set of flow charts illustrating particular aspects of the security and validation methods according to the present invention

Figure 7 is a block diagram of the aσplication software for the front end computers shown in Figure 1

Figure 8 is a diagrammatic illustration of the configuration for the front end computers 0 Figure 9 is a a diagrammatic illustration of the relationship between the reflective memory buffers in the front end computers, the transfer map in the IFS circuit and the data memory in the process control computers

Figure 10 is a block diagram of the IFS circuit shown in Figure 1

Figure 1 1 is a block diagram of the IFQ circuit shown in Figure 1 5

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring to Figure 1 , a block diagram is shown of an intelligent front-end communication system 10 which is coupled to a pair of actively redundant process control computers 12a- 12b. Each of the process control computers 12a- 12b receive common input data 0 from field computer units (not shown) or other suitable field instrumentation In this regard, the Glaser et. al. U.S. Patent Application Serial No. 07/864,931 , referenced above, describes in detail the communication and control links between a pair of actively redundant process control computers, such as process control computers 12a-12b, and the input/output devices directly associated with the physical process being controlled.

25 While the redundancy of two actively operating process control computers has certain fault tolerance advantages over a single decision making process control computer, it should be understood that the principles of the present invention are not limited to any particular configuration of process control computers Thus, for example, it may be desirable to employ three process control computers in the place of the two process control computers

30 12a- 12b shown in Figure 1 under the appropriate circumstances

In the present embodiment, the process control computers 12a- 12b preferably operate concurrently on all of the signals transmitted from one or more field computer units In other words, each of the process control computers 12a- 12b are capable of making independent decisions based upon the data received by these redundant computers from the

35 field The decisions made by the process control computers 12a-12b determine the output signal values which are ultimately directed to specific output devices (for example, valves, pump motors and reactor heaters) by the appropriate field computer units While the output signal values are preferably reconciled at least to some extent between the two actively reαunαant process control computers 12a- 12b beτore the transmission oτ these signals to the field, it should be unαerstood that two independent sets oτ output signal values could be communicated to the field computer units In this regard, the input values received from a field computer unit couiα be arbitrateα, which should make it unnecessary to reconcile or arbitrate output values This is because both of the process control computers 12a- 12b would then be working with the same process control program and operating on the same set of arbitrated input values

As an example of a preTerred form of possible value reconciliation, corresponding input value tables in each of the process control computers 12a- 12b could be compared during a preset time period, and one of the values could be chosen for each input value signal to be subjected to the process control program This selection of input values could be made on a suitable criteria to the process being controlled, such as the use of the value determined by the Left process control computer 12a when the value determined by the Right process control computer 12b is within a certain predetermined percentage limit (for example, 2.5%) Otherwise, the distinct input values of both the Left and Right process control computers could each De employed when these values are found to be outside the predetermined percentage limit Alternatively, the selection of different input/output values from the Left and Right process control computers could be made on the basis of a software implemented preference. Thus, for example, under certain process conditions, it may be considered more appropriate to select either the high or low value, regardless of whether the value was determined by the Left or Right process control computer

To facilitate this arbitration or reconciliation process, a parallel communication link 14 is provided between the process control computers 12a-12b Parallel communication link 14 is referred to as the "major" link, as it permits a direct transfer of data and timing signals between the process control computers It should also be noted that the Left process control computer 12a is labeled "fox ', while the Right process control computer 12b is labeled "dog" These are logical designations for alternative operating modes of the process control computers 12a-12b

While each of the process control computers 12a- 12b make independent decisions, which may be subject to arbitration, the process control computer currently in the fox mode has the ability to force the process control computer in the dog mode to move to a subsequent step in a programmed sequence in orαer to keep the cooperative efforts of the two process control computers in relative synchronization Additionally, the process control computer in the fox mode will transmit a timing signal to the process control computer in the dog mode at the beginning of its process control program cycle (for example, a one second period), so that the process control computer in the dog mode will know to begin a new process control program cycle as well As the process control computers 12a- 12b operate under their own clock oscillators, the detection and interpretation of this program cycle timing signal bv the process control computer in tne αog moαe will help to peπoαicallv keep these process control computers in relative synchronization However, it should be appreciated that the program cycle of the process control computer in the dog mode will typically follow the program cycle of the process control computer in the fox mode by the period of time it takes to transmit and then detect the program cycle timing signal (for example, 20-mιcroseconds to 20- milhseconds)

In the event that process control computers 12a- 12b are temporarily not able to communicate over the major link 14, each of these process control computers will continue their operations in a mode wnich assumes that they are operating alone In this mode of o operation, it should be appreciated that the program cycles of the process control computers 12a- 12b may gradually drift apart in time relative to each other Nevertheless, as will be seen from the discussion below, the front end communication system 10 is designed to enable data received from the process control computers 12a- 12b to be time aligned for real-time analysis As illustrated in Figure 1 , eacn of the process control computers 12a- 12b includes 5 a stealth interface according to the present invention In particular, process control computer 12a includes stealth interface circuit 16a, wnile process control computer 12b includes stealth interface circuit 16b. As the stealth interface circuits 16a- 16b comprise identical circuits, these stealth interface circuits are sometimes referred to generally herein as stealth interface circuit 16. Due to the redundant nature of the front end communication system 10, a general 0 reference number will also be used for other dup cative components in the system

The stealth interface 16 provides transparent data transfers between the process control computer to which it is connected and external communication devices In this regard, the data transfers are transparent to the pVocess control computer 12 in that the operation of the process control computer is not delayed or otherwise adversely affected by a transfer of its 5 data to one or more external communication devices. The stealth interface 16 also enables the transfer of messages from an external communication device without affecting the operation of the process control computer 2. The primary example of such an external communication device is shown in Figure 1 to be comprised of a pair of redundant front end computers 18a- 18b. The front end computers 18a- 18b are redundant, because communication paths are 0 provided for enabling each of these front end computers to exchange data and messages with both of the stealth interface circuits 16a- 16b

Each of the front end computers 18a-18b provide a highly intelligent interface between the stealth interface circuits 16a-16b and a plant local area network, which is generally designated by reference numeral 20. However, since each of the redundant front 5 end computers 18a-18b are capable of communicating with each of the stealth interface circuits 16a-16b, it should be appreciated that this redundancy is not required, and that a single front end computer could be utilized in the appropriate application. Additionally, as will be more apparent from the discussion below, each of the stealth interface circuits are capable of exchanging αata and messages with other external communication devices, as well as the front enα computers 18a- 18b.

As illustrated in Figure 1 , the stealth interface circuit 16 features a dual-ported memory "DPM" 22 which resides on the bus structure of the process control computer 12. c Indeed, in the embodiment disclosed herein, the dual- ported memory 22 provides the primary or only data memory for the process control computer 12. Thus, in accordance with the present invention, the stealth interface circuit 16 will selectively grant external devices direct access to the data memory of the process control computer itself. The dual-ported memory 22 includes an internal port which is connected to the bus structure of the process control computer 12 and

1 o an external port, which is sometimes referred to herein as the stealth port. While the dual- ported memory 22 could be configured to provide additional ports, the dual-ported memory preferably includes an arbitration circuit which enables a plurality of external communication devices to have alternative access to the stealth port. In other words, only one external device will be able to use the data and address lines of the stealth port at any given time when access

15 to the dual-ported memory is permitted through the stealth port, even though more than one external device may ultimately be coupled to the data and address lines of the stealth port. In the present embodiment, the stealth interface arbitration circuit employs a first-come, first- serve approach to granting access rights.

However, in accordance with the present invention, this arbitration circuit

20 operates only on the stealth port. There is no arbitration per se between the internal and external ports of the stealth interface circuit 16. Rather, access to the dual-ported memory 22 from the external/stealth port is available only during those times when the process control computer 12 cannot access the dual- ported memory. More specifically, in the form of the invention disclosed herein, the machine cycle of the process control computer 12 is utilized to

25 control access to the dual-ported memory 16. As is well known, the central process unit of any computer must fetch and decode one or more programmed instructions in order to operate on one or more data words. In computers based upon the von Neumann architecture, it typically takes several computer clock cycles to fetch, decode and execute an instruction. However, in the present embodiment, the process control computer 12 is based on the Harvard architecture,

30 which permits both an op-code instruction and the operand data for this instruction to be fetched in the same clock cycle. This is because a computer based upon the Harvard architecture includes physically separate instruction and data stores, and each of these stores have their own address and data lines to the central processing unit. Thus, during the portion of the clock cycle for the process control computer 12 that is devoted to fetching and decoding

35 an instruction, the dual-ported data memory 22 may be accessed from the stealth port. Then, during the portion of the clock cycle for the process control computer 12 that is devoted to fetching the operand from the data store, the process control computer will have access to the dual- ported data memory 22 from the internal port. In accorαaπce with the present invention, the stealth interface circuit 16 watches ;or a specific transition in the memory clock signal of the process control computer 12 in order :o determine wnen tne stealth port may have access to the dual-ported data memory 16 In this ^regard, it should be understood that the process control computer itself is not affected by this external access, as external access is permitted by the stealth interface circuit 16 only during those time periods when the process control computer 12 will not need to access the dual- Dorted data memory 22 Indeed, the process control computer 12 does not even have to know that externally generated read/write activity is actually occurring with respect to its data store. Nevertheless, in accordance with the present invention, an important distinction is made oetween the ability to " read " from the dual-ported data memory 22 and the ability to "write" to the duai-ported data memory, as far as the stealth port is concerned. While it may be αesiraole to enable an external communication device to read each and every memory location in the dual-ported data memory 22, this may not be true with respect to the ability of an external device to write to memory locations in the dual-ported memory In this regard, the dual-ported data memory 22 will store not only dynamic data associated with the physical process being controlled, but it may also store other process control variables, such as analog and digital constants.

Accordingly, the dual-ported memory 22 includes two " logical " memory sections, namely variable section 24 and mailbox section 26. These memory sections are logically distinct, because they are treated separately, even though they may both reside in the same physical memory circuit chip or chip set. In the present embodiment, the mailbox section 26 is comprised of a set of 256 memory word locations (16 bits each) in the dual-ported data memory 22, and the variable section 24 is comprised of the remaining memory locations in the dual- ported data memory 22 (for example, a block of 64k memory word locations). The variable section 24 may also include a message area for holding system messages from the process control computer 12 to the front end computer 18. The mailbox section 26 is used to provide a specific region in memory for storing messages from external devices, such as the front end computers 18a-18b. In this regard, it should be appreciated that the memory locations of the mailbox section 26 do not need to be physically contiguous. While the mailbox section 26 may be configured to hold more than one message at any one time, depending upon the message transmission protocol employed, the mailbox section need only be large enough to hold one complete message. These messages may be as simple as an external request for the process control computer 12 to gather and transmit health/status data from a remote field computer unit that it may obtain less frequently. A message may also include a command to change a particular variable stored in the dual-ported data memory 22. Additionally, the mailbox section 26 of the dual-ported data memory 22 may also be used to electronically convey a program revision to the process control computer 12. As will be more fully discussed below, tne stealth interface circuit 16 includes a guardian circuit which prevents any external entity from writing to any memory iocations in the variable section 24 of the dual-ported data memory 22. Thus, while some or all of the memory Iocations in the dual-ported data memory 22 may Pe reao from the stealth port, an external entity is only permitted to write to the memory Iocations in the mailbox section 26 of the dual-ported memory 22. This feature of the present invention provides a hardware safe¬ guard at the process control computer 12 which insures that no external entity will be able to inadvertently interfere with the data processing operations of the process control computer 12. As will be more apparent from the discussion below, this feature of the present invention could o aiso be employed to grant or deny external write access to any particular memory location or set of memory Iocations in the dual-ported data memory 22.

In order to rapidly pump data into or out from the stealth port, the front end communication system 10 of Figure 1 is also shown to include an interface to stealth "IFS" circuit 28, an interface to Q-bus " IFQ" circuit 30, and a set of fiber optic cables 32 interposed 5 therebetween. The IFS circuit 28 is connected to the stealth port of the dual-ported data memory 22, while the IFQ circuit 30 resides on the "Q bus" of the front end computer 12. Due to the redundant nature of the front end communication system 10, it should be appreciated that the IFS circuit 28a is connected to the stealth port of dual-ported data memory 22a, while IFS circuit 28b is connected to the stealth port of dual- ported data memory 22b. Similarly, the 0 IFQ circuit 30a is connected to the Q bus of the front end computer 18a, while the IFQ circuit 30b is connected to the Q bus of the front end computer 18b. In the embodiment disclosed herein, the front end computer 18 is preferably comprised of a MICROVAX 3400 computer using the real-time ELN operating system from the Digital Equipment Corporation "DEC". While the VAX family of computers from DEC offer considerable speed and networking

25 advantages, it should be appreciated that other suitable front end computers may Pe employed in the appropriate application.

In order to permit each of the front end computers 18a-18b to conduct bi¬ directional communications with both of the stealth interface circuits 16a- 16b, the fiber optic cables 32 actually include two sets of send and receive optical fibers (for example,

30 62.5/125/0.275NA type fibers). However, the separate send and receive optical fibers for each of the front end computers 18a-18b are represented as single channels in Figure 1 for simplicity. Thus, fiber optic channel 34a includes a separate optical fiber for sending information from the front end computer 18a to the stealth interface circuit 22a and an optical fiber for receiving information from the stealth interface circuit 22a. Similarly, the fiber optic channel 36a

35 includes a separate optical fiber for sending information from the front end computer 18a to the stealth interface circuit 22b and an optical fiber for receiving information from the stealth interface circuit 22b. This arrangement of optical fibers is also duplicated for the front end computer 18b. 'n the present emoodiment, the comoination oτ the IFS circuit 28, the IFQ circuit 30 and the fiber optic cables 32 provide an optical transmission interface which permits the front end computers 18a- 18b to be remoted located from the process control computers 12a- 12b For example, in this emoooi mem it is possiDle τor the front end computers 18a- 18b to be located upto 2 km from the process control computers 12a-12b Additionally, it should be noted that the Fiber Distributed Data Interface " FDDI" protocol may be used to transmit information between the IFQ and IFS circuits overthe fiber optic cables 32

The IFS circuit 28 includes the appropriate address and data buffer circuits (not shown) for trans^ferring information to and from the stealth port of the dual-ported data

1 o memory 22. The IFS circuit 28 also includes a transfer map 37 which enables data from selected locations in the dual-ported data memory 22 to be gathered and transferred as one contiguous block of data The transfer map 37 may be comprised of a static RAM with sufficient address storage capability to gather data from all of the available memory locations in the dual- ported data memory 22

15 Additionally, the IFS circuit 28 includes a separate transmitter and receiver circuit for each of the two front end computers 18a- 18b, such as transmitter 38a and receiver 40a. The transmitter 38a is adapted to convert parallel data words (for example, 16 bits) from the stealth port into a serial bit stream suitable for transmission over one of the fiber optic cables 32. Similarly, the receiver 40a is adapted to convert a serial bit stream from the front end computer

20 18 into a parallel data word for transmission to the stealth port through one or more of the IFS circuit buffers. A corresponding set of transmitters and receivers are also provided in the IFQ circuit 30, such as transmitter 38b and receiver 40b From the above, it should be appreciated that the use of two sets of transmitter-receiver pairs enables data to be transferred and/or received simultaneously between both of the IFS circuits 28a-28b and both of the IFQ circuits

25 30a-30b Thus, for example, the IFS circuit 28a is capable of simultaneously transmitting data acquired from the process control computer 12a to both of the front end computers 18a-18b. While not shown for illustration simplicity, it should appreciated that a laser or LED light source is interposed between each of the transmitters (for example, transmitters 38a- 38b) and their respective optical fibers Similarly, a photo- detector is also interposed between

30 each of the receivers (for example, receivers 40a- 40b) and their respective optical fibers. For example, these light converters may be comprised of a oair of AT&T ODL200 series converters While fiber optic cables are preferred for their speed, low error rate and security advantages over mediums such as coaxial cable, it should be understood that that other suitable data transmission medium could be employed in the appropriate application

35 In the present embodiment, the transmitters and receivers in the IFS and IFQ circuits are preferably comprised of a high-performance Gallium Arsenide chipset, such as the "Gazelle" GA901 1 transmitter and GA9012 receiver from Tπquint Semiconductor, Inc., 2300 Owens St., Santa Clara, CA These particular transmitters and receivers permit data transmission rates in excess of 200 M bits/second These transmitters ana receivers utilize a 40- Diτ wide parallel bus wnicn enables data to be encoded into a 50-baud word using FDDI- standard 4B/5B encoding In this encoding, 4-bιt data nibbles are translated into a 5-baud code svmool Accordingly, tne 4B/5B encoding produces ten 5-bauo symools from ten 4-bιt data niobles in order to comoπse a data frame. The GA901 1 transmitters also convert the serial stream from a Non-Return to Zero ' NRZ" format to a Non-Return to Zero, Invert on ones ' NRZI" format, wnich combines the transmission of data and CIOCK signals into a single waveform The NRZI waveform denotes a logical one with a polarity transition and a logical zero with no transition within the bit-time-frame These logical ones and zeros are called o bauds, and each group of five bauds are called a symbol. For example, a "0000" 4-bιt binary input will be converted to a " 1 1 1 10" 5-baud binary symbol output, while a " 101 1 " 4-bιt binary mout will be converted to a ' 101 1 1 " 5-baud binary symbol output.

The use of 4B/5B encoding and NRZI formatting comoine to substantially enhance the reliability of high-speed data transmissions over the fiber optic cables. The GA9012 5 receivers have built in clock and data recovery (for example, NRZI to NRZ conversion), and they also monitor the incoming 5B symbols for validity. In this regard, the 4B/5B encoding creates a number of invalid symbols which may be checked for at the GA9012 receivers As the presence of noise or jitter across the fiber optic link could cause one or more of the bauds to change to an unintended value, the detection of invalid symbols reduces the possibility of a transmission 0 error going undetected.

As an additional layer of protection from potential errors, data transmissions from the IFS circuit 28 are formed into complete data frames, which are comprised of the data to be transferred (that is, the 40-bιt input data frame), a 16-bιt destination address field, a 4-bιt control code field and a 4-bιt error detection code field. These complete data frames are 5 preferably separated from each other on the fiber optic link by at least one sync frame. As potential physical link errors may have a burst or clustering nature, the error code needs to be able to detect up to four contiguous bit errors. In this regard, a Longitudinal Redundancy Check "LRC" code is employed to prevent masked errors from potentially corrupting subsequent data processing operations This type of error code is also referred to as a 0 " Longitudinal Parity Check" In a LRC code, a 4-bιt nibble composed of parity bits is generated and inserted into the encoded data stream for a predetermined number of data nibbles in the encoded data stream, as shown below: b4 b3 b2 b1 data nibble 1 x x x x 5 data nibble 2 x x x x data nibble 3 x x x x data nibble 8 I x x x x I αata nibble 9 | x x x x |

αata nibble 10 , p4 p3 p2 p1 | wnere pi = bi 1 Xor bι2 Xor Xor bι9, and i = bit location 1 to 4 Thus, the ith bit of this parity check character checks the ith information bit position in data nibbles 1 through 9 under even parity conditions The combination of the LRC error checking, the 4B/5B encoding and the NZRI conversion enable the front end communication system 10 to provide a targeted Baud Error Rate "BER" of 1 E- 12 While a Cyclic Redundancy Check "CRC" code could be employed in lieu oτ the LRC code, the more complicated CRC code would also increase the complexity of the IFQ and IFS circuits Additionally, the LRC coding more readily permits dual fiber optic channel signal transmissions between the IFS and IFQ circuits, and the intrinsic synchronization features oτ the the Gazelle transmitters 38a-38b and receivers 40a-40b may be used to frame the LRC based protocols The IFQ circuit 30 includes a microprocessor 42 (for example, an Intel 80186 chip) wnich provides the data pump for the front end computer 18 The microprocessor 42 is not only responsible for all IFQ/IFS protocol control and relaying data from the process control computers 12a-12b to a destination on the network 20, but it is also responsible for controlling the integrity of write activities to the IFS and IFQ circuits For example, the microprocessor 42 rnay be used to program the transfer map 37 in the IFS circuit 28, so that only a particular sub¬ set of data in the dual-ported data memory 22 may oe gathered and transmitted to the front end computer 18, if less than all of the available variables (for example, input/output values, alarms and events) is desired In this way, the actual contents of the transfer map 37 may be dependent upon a specific process control application All signal transmissions between the IFQ circuit 30 and the IFS circuit are under tne control of IFQ circuit microprocessor 42 In this regard, there are three types of data transmissions from the IFQ circuit 30 to the IFS circuit 28, namely " load transfer map", "send command messages" and " receive data" The load transfer map transmission will enable the IFQ circuit 30 to load the transfer map 37 of the IFS circuit 28 with the specific variable addresses which will steer the data memory transmit bursts from the IFS circuit The receive data transmission will cause the IFS circuit 28 to return the requested segment of memory from the dual-ported data memory 22

A command message transmission will start with a Wπte-Lock request to the IFS circuit 28 Assuming that incoming buffer is free, the IFS circuit 28 will assert a Write-Lock on the mailbox section 26 of the dual-ported data memory 22, and return a positive acknowledgement to the IFQ circuit 30 The IFQ circuit 30 may then transmit its message with the assurance that no other device will be able to write to the mailbox section 26 until its message has been completely stored and preferably read by the process control computer 12 -ιowever, a time limit may be imposed on the Write LOCK to ensure that the flow of communications is not impeded by one of the external entities connected to the stealth interface circuit 16. It should also be appreciated that message transmissions should not take place during any time in wnich a data burst should be received from the IFS circuit 28. As another measure of data transmission protection, the IFQ circuit 30 will cause the IFS circuit 28 to read back a message transmitted to and stored in the mailbox section 26 of the dual-ported data memory 22 in order to be sure that the message was transmitted and stored correctly. Once the IFQ circuit 30 determines that the message has been accurately received and stored, then the IFQ circuit will cause a flag to be set which will signal the process control computer 12 to pick up the new message. In the event that this data verification fails, then the entire message transmission process will be repeated.

The IFQ circuit 30 also includes a process data buffer 44, which is shown as block in Figure 1 for illustration simplicity. However, the process data buffer 44 should include sufficient memory capacity to store a separate data table for each of the process control computers 12a-12b (for example, 262, 144 bytes). Each of these data tables will include both the SDS5 and DSS data transmissions. Additionally, a DMA buffer (not shown) may also be provided to allow some elasticity in processing the data being received. In this regard, it should be noted that the both the IFS circuit 28 and the IFQ circuit 30 are configured to facilitate bi¬ directional Direct Memory Access "DMA" transfers between the IFQ circuit 30 and the Q-bus of the front end computer 18. In this way, the central processing unit 45 of the front end computer 18 does not need to devote substantial time to processing data transfers to and from the IFQ circuit 30. Accordingly, the DMA buffer is preferably used as a bucket brigade area to perform DMA transfers on blocks of data from the process data buffer 44 (for example, 8K bytes at a time) to a suitable memory residing on the Q-bus of the front end computer 18. The use of DMA transfers also enhances the ability of the front end communication system 10 to achieve the goal of making available real-time data from the process control computers 12a- 12b to one or more computers on the network 20. More specifically, the front end communication system 10 is designed to request, receive and answer network queries on both pre-link and post- arbitrated data from each of the process control computers 12a-12b within a one- second time resolution. For example, in this particular embodiment, each of the process control computers 12a- 12b will issue a Sequence Data Stable Strobe "SDDS" signal in every one-second program cycle, which indicates that approximately 1024 (16 bit) words of pre-link dynamic analog/digital input data is stable and available in the dual-ported data memory 22. This specific data set is referred to as pre-link data, as this data has not yet been arbitrated between the process control computers 12a-12b via data transmissions across the major link 14. Subsequently, in the same one-second program cycle, each of the process control computers 12a- 12b will issue a Data Stable Strobe " DDS" signal, which indicates that a complete set of post-arbitrated input and output data is stable and available in the dual-oorted data memorv 22 This oata set is reTerred to as post-aroitrated, as tne input values wπl have been arbitrated or resolved by this point in the program cycle In the present embodiment, this post- arbitrated oata set mav be comprised of uo to 65,536 (16-bιt) ords, as it will include both input and output values (and any other variables stored in the dual- ported data memory 22)

It should also be noted at this point that one of the first functions in the program cycle of the process control computers 12a- 12b is to make output value decisions from the post- aroitrated input data obtained in the immediately preceding program cycle Accordingly, it should be appreciated that the post- arbitrated data set will include the arbitrated input values o from the current program cycle ana the output values from the immediately previous program cycle

It is also important to understand that the function of obtaining a copy of the pre-link and post-arbitrated data sets cannot be permitted to delay the operations of the process control computers 12a- 12b Thus, for example, the front end communication system 10 5 must be sufficiently fast to obtain a copy of the Dre-lmk data sets before the process control computers 12a-12b need to have the ability to change one or more of these data values through the arbitration process. Accordingly, in the context of the present embodiment, the front end communication system 10 needs to be able to acquire a pre-link data set within ten milliseconds of the time that the SDSS signal was initially asserted in order to have the 0 assurance of data stability. Similarly, the front end communication system 10 needs to be able to acquire a post-arbitrated data set within fifty milliseconds of the time that the DSS signal was initially asserted. In this regard, it should be appreciated that each of these data sets need to be independently acquired from both of the process control computers 12a- 12b by each of the front end computers 18a-18b. Additionally, each of the front end computers 18a-18b must

25 also be able to send messages to the one or both of the process control computers 12a-12b during time periods outside of the SDSS and DSS data acquisition windows.

In order to further facilitate the ability of the front end communication system to acquire the SDSS and DSS data sets without any data transfer blocknecks, and also provide the ability to group and time align the data sets being received, each of the front end computers

30 18a- 18b inci udes a set of at least three reflective buffers for each of the process control computers 12a-12b Each of these logically distinct reflective buffers or shadow memories may reside in the same physical memory chip or chip set in the front end computer 18. As shown in Figure 1 , the set of reflective buffers contained in the front end computer 18a is generally comprised of a ZERO buffer "ZL" 46a for the Left process control computer 12a, a ZERO buffer

35 "ZR" 48a for the Right process control computer 12b, a ONE buffer "OL" for the Left process control computer, a ONE buffer "OR" for the Right process control computer, a TWO buffer "TL" for the Left process control computer, and a TWO buffer "TR" for the Right process control computer Additionally, it should be understood that a corresponding set of reflective Duffers are contained in the tront end computer 18b, such as tne ZERO buffer "ZL" 46b for the _eft process control computer 12a and the ZERO buffer "ZR" 48b for the Right process control computer 12b

The iFQ circuit 30 writes to these left ano πgnt buffers in a round robin" fashion using DMA data transfers In other words, the IFQ circuit 30 will fill the ZERO buffer 46a with ore-link and post-arbitrated data of a particular process control cycle from the Left process control computer 12a Tnen, wnen pre-link and post-arbitrated oata for the next process control cycle is received from the Left process control computer 12a, the IFQ circuit will increment to the ONE buffer 50a in order to store this data Similarly, the IFQ circuit 30 will turn to the TWO buffer 54a when pre-link and post-arbitrated data for the third process control cycle is received from the Left process control computer 12a in order to store this data Then, when pre-link ana post-arbitrated data for the forth in time process control cycle from the Left process control computer 12a is to be stored, the IFQ circuit 30 will return to address the ZERO buffer 46a for data storage. Of course, it should be appreciated that the IFQ circuit 30 will employ the same round robin sequence for individually transferring ore-link and post- aroitrated data to the three reflective buffers 48a, 52a and 56a that are used for the Right process control computer 12b

For purposes of illustration, Figure 1 shows three reflective memory buffers (46a, 50a and 54a) for the Left process control computer 12a, and three reflective memory buffers (48a, 52a and 56a) for the Right process control computer 12b However, as the SDSS and DSS data transfers are treated as independent DMA events, the reflective memory buffers preferably include distinct reflective memory buffers for each of these events. Accordingly, a total of twelve reflective memory buffers are preferably provided in the front end computer 18. Additionally, each of these reflective memory buffers are individually tracked, so that the ordering of these buffers do not necessarily have to follow the regimen snown below: Second N: (ZERO-SDSS-L ZERO-DSS-L ZERO-SDDS- ZERO-DSS-R)

Second N + 1 : (ONE-SDSS-L ONE-DSS-L ONE-SDDS-R ONE-DSS-R)

Second N + 2 (TWO-SDSS-L TWO-DSS-L TWO-SDDS-R TWO-DSS-R)

Rather, the ordering of these buffers could also proceed under other regimens, such as shown below:

Second N: (ONE-SDSS-L TWO-DSS-L ZERO-SDDS-R ONE-DSS-R)

Second N + 1 ^■ (TWO-SDSS-L ZERO-DSS-L ONE-SDDS-R TWO-DSS-R)

Second N + 2 (ZERO-SDSS-L ONE-DSS-L TWO-SDDS-R ZERO-DSS-R)

It is important to understand that the corresponding left and right reflective Duffers (for example, buffers 46a and 48a) will generally not become filled at the same time, as the program time line of the process control computer in the dog mode should follow the program time line of the process control computer in the fox mode by a predeterminable period of time (for example, 20-mιcroseconds to 20- milliseconds). However, these time lines T-ay become considerably separated in the event that communications across the major link 14 are not possible, as mentioned above. Even when the left and right SDSS or DSS signals are asserted at near the same time, the delays required to transfer this information to the IFQ crcuit 30 and then transfer this information into the appropriate reflective memories may result in a wioertime sxew between these events as seen by the application software of the front end computer 18 than as seen by the process control computer and IFS circuit hardware. Nevertheless, it is the responsibility of the front end computer 18 to ensure that the data sets ultimately made available to the computer network 20 represent data from the process control computers 12a-12b in the same program cycle (for example, a one second period) In this regard, the application software of the front end computer 18 includes a procedure, referred to as "Ml Sync", which groups individual data transfer events into a cohesive set of buffers that represent a "snapshot" of the pre-link and post- arbitrated data for a particular process control cycle

The Ml Sync procedure uses a set of reflective memory buffer management structures (Ml RMBMS) to track the status of incoming data transfers When the IFQ circuit driver software signals to the Ml Sync procedure that a DMA transfer has completed, Ml Sync records the required information in the appropriate Ml RMBMS data structure. When Ml Sync determines that a complete set of buffers has been received and stored (that is, left SDSS, right SDSS, left DSS and right DSS), it updates a global data structure (MI_RM_DATA) with the ^pointers to the newly received data These pointers are copied from the Ml RMBMS data structure. Accordingly, Ml RM DATA includes the pointers to the currently available

"complete" or time aligned set of reflective memory buffers. Depending upon where the front end computer 12 is in the round robin procedure, the most current time aligned set of reflective memory buffers may be TWO buffers 54a and 56a at one time interval, the ONE ouffers 50a and 52a at the next time interval, and the ZERO buffers 46a and 48a at the following time interval. In the event that the SDSS or DSS data from one of the process control computers 12a- 12b is not received by the IFQ circuit 30, Ml Sync will still maintain time alignment by using an appropriate timeout (for example, 700 milliseconds) for updating the Ml RM DATA pointers An indication will also be provided as to which buffer or buffers are unavailable.

The buffer pointers within Ml RM DATA are protected by a mutual exclusion semaphore or "mutex" . Ml SYNC requests this mutex before copying the new pointers to

Ml RM DATA and releases it immediately after the copy is comolete When a network entity needs to access reflective memory data, a copy of the Ml RM DATA pointers is made by reouesting the mutex, copying these buffer pointers to a local data structure, and then releasing the mutex Since the application for querying or reading the data uses a copy of the pointer, contention for the mutex is minimized, and Ml Sync will be able to update

Ml RM DATA with new pointers as soon as the next complete set of data has been stored. In this regard, it is important to note that this method will enable the reading application to still access the same set of reflective memory buffers while Ml Sync updates Ml RM DATA with new pointers. Since reading apDlications will access the most current time aligned set of reflective memory buffers, it should be understood that a reading application could be accessing one set of reflective memory buffers (for example, the TWO buffers 54a and 56a), while a subsequent reading application could be given access to another set of reflective memory buffers (for example, the ONE buffers 50a and 52a) once Ml Sync updates Ml RM DATA with new pointers.

It should also be understood that applications which access the reflective memories will be able to run to completion before the referenced buffers are overwritten with new incoming data. In one embodiment of the front end communication system 10, applications requiring reflective memory data are assigned execution priorities high enough to allow them to run to completion in less than one second. However, it should be appreciated that the front end computer 18 could be configured with additional sets of buffers to allow the development of an application that may take longer to run to completion.

It should also be appreciated from the above that the use of the front end computers 18a-18b also enables the communication system 10 to have the necessary intelligence to answer specific data requests. The use of the front end computers 18a-18b also permit a rapid check to be made that the process control computers 12a-12b are in fact continuing to send real-time data. Additionally, the front end computers 18a-18b are also preferably programmed to make determinations as to whether read or write requests from the process control computers 12a- 12b should be granted with respect to the entity on the computer network 20 which has forwarded the request. As will be discussed more fully below the front end computers 18a- 18b contain both a security table and two permissive tables in their memories for facilitating these determinations. The security table is used determine whether communications will be permitted at all with various entities on the computer network 20, while the permissive tables are used to evaluate write command messages from an entity on the computer network which could affect specific Iocations in the dual-ported data memories 22a-22b. The front end computers 18a- 18b may also utilize at least one set of additional reflective buffers, such as Correlate buffers 58a and 60a. In light of the fact that the DSS data set will contain the post-arbitrated input value data from the current program cycle and the output value data that was based upon the post-arbitrated input values of the immediately preceding program cycle, it may be desirable to correlate into one data table the output values for a particular program cycie with the input values used to decide these output values. Accordingly, the front end computer 18a may employ the Correlate buffers 58a and 60a to store a copy of the post-arbitrated input values from the current DSS data set, and then wait for the alignment of the next DSS data set in order to store a copy of the output values from this suPsequent data set in the same Correlate Duffers in this regard, it should be appreciated that tnis copying procedure will be made from the most current time aligned set of reflective memory buffers Thus, for example, Figure 2A shows a diagrammatic example of a data table in a time aligned buffer, wniie Figure 2B shows a similar example of a data table in the Correlate buffer CL. In any event, it should be understood that the time alignment capabilities of the front end computers 18a- 18b provide a powerful diagnostic tool for analyzing both the o^peration of the process control computers 12a-12b and the physical process being controlled. For example, the arbitration performed with respect to the input data values may be analyzed for both of the process control computers 12a- 12b, as ore-link and post-arbitrated input data values are time aligned and made available by the front end computers 18a-18b.

The computer network 20 is shown in Figure 1 to generally include a direct control segment, a process information segment and a connection to a Wide Area Network "WAN". Each of these network segments preferably employ Ethernet compliant mediums and IEEE 802.3 compatible communication protocols. The direct control segment is comprised of dual Plant Area Networks "PAN-1 " and "PAN-2" , wnile the process information segment is comprised of Plant Area Network "PAN-3" At least one bridge 62 is used to interconnect the PAN-1 and PAN-2 segments. Additionally, at least one bridge 64 is used to interconnect the PAN-2 segment with the PAN-3 segment. Another bridge may be used to interconnect the PAN-1 segment with the PAN-3 segment. One or more bridges 66 may also be used to interconnect the PAN-3 segment with the WAN

It should be noted that the front end computer 18a is coupled to the PAN-1 segment, while front end computer 18b is coupled to the PAN-2 segment. While a single plant area network could be provided, the use of dual plant area networks shown herein have certain communication and redundancy advantages over a single plant area network. In this regard, the bridges will typically filter communications by Ethernet hardware addresses to reduce the amount of traffic on each of the network segments. For example, a communication between the security server 68 and the operator station 70 will not be transmitted across the bridge 62 to the PAN-1 segment. The bridges 62-66 also provide a layer of physical separation between the network segments, so that if a fault occurs on one of the network segments, then the fault will be prevented from adversely affecting the other network segments.

Additionally, one or more of the bridges are also used to filter communications on the basis of specific data communication protocol identifications to enhance the overall security of the network 20. For example, the bridge 64 may be used to prevent the transmission of messages employing the Ethernet compliant protocol used by the security server 68 from one of the PAN- 2 and PAN-3 segments to the other. Similarly, the bridge 64 may be useα to prevent the transmission of messages employing the Ethernet compliant protocol used to write information into the mailbox section 26 of the dual-ported data memory. The computer network 20 also includes a plurality of operator workstations, such as operator workstations 70 and 72. As shown in Figure 1 , these operator workstations may be located on different network segments, and the number of operator workstations will be dependent upon the particular process control application. One or more of these operator worKstations may be used to view or analyze data recei ed from the front end computers 18a- 18b. Additionally, these operator workstations may be used by an authorized control room operator to transmit the appropriate instructions to the front end computers 18a- 18b which will cause a command message to be conveyed to the process control computers 12a- 12b.

The network 20 further includes a process information computer 74 which may o perform a variety of functions. For example, the process information computer may be used to store a history of process data received from the front end computers 12a-12b. Additionally, the process information computer 74 may be used to store the compilers needed to change the computer programs residing in the front end computers 18a- 18b, as well as the programs residing in the process control computers 12a-12b. The process information computer 74 may 5 also include loading assistant software for transferring operating program revisions to the process control computers 12a-12b. The network also includes a control room data manager computer 76, which may be used to perform various file serving and tracking functions among the computers connected to the network.

An expert download assistant 78 is also provided to facilitate program revisions in 0 the front end computers 18a-18b. In contrast, the loading assistant software in the process information computer 74 may be used to cause a new computer program to be downloaded to one of the process control computers 12a- 12b through at least one of the front end computers 18a-18b and the mailbox section 26 of the dual-ported data memory 22. While the download assistant 78 may be resident in its own network computer, the download assistant could also 5 reside in a suitable network computer, such as the process information system computer 74.

The loading assistant may also be used to cause the process control computer with the revised program to start operating in a mode which will enable real-time testing of the revised program. In this mode of operation, the process control computer will receive input data and make output decisions, but these output decisions will not be transmitted to the field 0 instrumentation devices. This will permit the plant engineer to evaluate the revisions, and even make further revisions if necessary before instructing the process control computer to assume an active mode of operation, such as the fox or dog modes.

Whenever it is decided that the manner in which the process control computers 12a- 12b perform their particular manufacturing control operations should be changed 5 through a program revision, the revised program for the process control computers 12a-12b must be compiled from the the source programming language to an executable file or set of dynamically linked files. In the preferred embodiment, a unique identifier is embedded into the executable code during the compile procedure. This identifier represents (or is otherwise associated with) the version of the revised software for the process control computers 12a-12b Tne program version identifier is used to ensure proper alignment between the version of the program being executed by the process control computers 12a- 12b and the files/tables in the ^*ront eno computers 18a- 18b used to evaluate write command messages to these process control computers

As mentioned above, each of the front end computers 18a-18b include two permissive tables, such as the "PL" permissive table 80a for the Left process control computer 12a, and the "PR" permissive table 82a for the Right process control computer 12b These permissive tables are used by the front end computers 18a- 18b to determine whether any o entity on the computer network 20 should be permitted to change the contents of sσecific iocations in the dual- ported data memories 22a-22b. However, it should be appreciated that the data structure of the permissive table could be constructed to protect the contents of any memory location or area in the process control computers 12a-12b which could altered from a write command message 5 When a message is recei ed by a front end computer 18 from an entity on the network which uses the write command protocol, sucn as a write commanα message from one of the operator workstations 70-72, a 'data write check" sub- routine will be called by the central process unit of front end computer The data write check routine will perform a comparison between the variable elements identified in the write command message and the 0 variable elements in the permissive table for which changes should be authorized or denied For example, if the front end computer 18a receives a write command message which seeks to increase/decrease an analog gain "AG" factor used by the program being executed by the Left process control computer 12a, the front end computer 18a will look up the element word for this particular AG factor in permissive table 80a and determine if a bit has been set to deny the 5 authorization needed to change this factor If authorization is denied, then the front end computer 18a will not transmit the write command message to the process control computer 12a. Instead, the front end computer 18a will preferably send a reply message to the host entity on the computer network 20 that originally sent the write command message, to inform the host entity that a write error has occurred 0 From the above, it should be appreciated that the PL and PR permissive tables stored in the front end computers 18a-18b need to be closely coordinated with the version of the program being executed by each of the process control computers 12a-12b In order to ensure that each of these permissive tables are sufficiently matched with the Drograms being executed by their respective process control computers 12a- 12b, the program version identifier 5 discussed above is also embedded into these permissive tables when they are compiled This program version identifier may then be sent to the process control computer 12 along with a verified write command message, so that the process control computer 12 will be able to confirm that the commanded variable change is appropriate to its program version To ennance the security of tnis verification process, the program version identifier from the permissive table is preferably altered by a suitable encryption algorithm before it is transmitted with the write command message to the mailbox section 26 of the stealth interface circuit 16 for the intended process control computer 12. The process control computer 12 receiving the write command message will then decode this version identifier, and compare it with the program version identifier embeαded in its program to determine if their is a match. If the program version identifiers match, then the process control computer 12 will perform the commanded variable change. Otherwise, the process control computer 12 will respond by discarding the write command message and transmitting an appropπate error message to the o front end computer 18.

The PL and PR permissive tables are also preferably provided with a data structure which permits write command authorization determinations to be made for specific host entities on the computer network 20. In other words, the permissive table 80a may permit particular variable changes to be made from operator workstation 70 that are not allowed to 5 be made from operator workstation 72. Thus, the permissive tables may have several station specific table sections, as well as a default table section. Nevertheless, the ability may also be provided to bypass a check of the appropriate permissive table, through the use of a suitable password at a host entity on the computer network 20. However, in this event, a log should be created and stored in the front end computer 18 whicn will identify this transaction and the 0 identity of the host entity (for example, a CPU identifier).

It should be noted that the use of separate permissive tables for the process control computers 12a-12b has the advantage of enabling a program downloading operation to be performed on one of the process control computers while the other process control computer continues to actively control a manufacturing process. Indeed, even after a revised 5 program has been successfully transferred to the process control computer 12a (and the corresponding permissive table 80a loaded in front end computer 18a), the use of separate permissive tables will enable the front end computer 18a to evaluate a write command message intended for the process control computers 12a which is distinct from a write command message intended for the process control computer 12b. While it may not be 0 advisable in some circumstances to run the process control computers 12a-12b with different program versions in an active control mode, a passive operating mode may be used for the process control computer with the revised program while the other process control computer is in an active control mode, in such an event, the plant engineer may use the download assistant 78 during final program testing to issue write command messages for the passive process 5 control computer, while another plant engineer issues write command messages to the active process control computer through the same front end computer 18.

The security server 68 is used to inform each of the computers residing on the network 20 who they may communicate with on the network. In this regard, the security server stores a specific security table τor each oτ the valid entities on the network Each of these security tables will ιdentιτy which ot the network computer entities a particular network computer may conduct bi- directional communications For example, in tne case of the front end computers 18a- 18b, one or the first functions on start up will be to obtain their respective security tables from the security server 68 Accordingly, the security server 68 is shown in Figure 1 to store a security table "S1 " for the front end computer 18a, and a security table "S2" for the front end computer 18b While the security server could also be used to send the PL and PR permissive tables discussed above to the front end computers 18, it is preferred that newly compiled permissive tables be received from the download assistant 78 In this regard, it should o oe noted that the download assistant is also preferably used to send the transfer map 37 intended for the IFS circuit 28 to the front end computer 18 along with the appropriate permissive table

In order to assure the integrity of security table transfers from the security server 68 to the front end computers 18a- 18b, a method of validating these transfers is utilized in the 5 present embodiment In accordance with this method, the front end computer 18 will embed a random or pseudo-random number in a broadcast network message to request that the security server 68 identify itself as a prelude to sending the appropriate security table The security server will respond to this request with an acknowledgement message that utilizes a security protocol identifier which is different than that used with other types of network 0 messages Importantly, this acknowledgement message will include the random number from the front end computer 18 in a transformed state In this regard, a suitable encryption algorithm may be used to alter the random number, and the random number should have a bit length which will make it difficult for any unauthorized entity to decode (for example, 32 bits) Upon receipt of the acknowledgement message, the front end computer 18 will then either 5 reverse the encryption process to obtain the random number or encrypt its original random number to make a comparison between the transmitted and received random numbers Assuming that these random numbers match, then the front end computer 18 will determine that the acknowledgement message has been received from a valid security server, and the transfer process will proceed. 0 In order to further enhance the security of communications between the front end computers 18a-18b and other entities on the computer network 20, an additional validation procedure is preferably implemented More specifically, this additional validation procedure is utilized to permit communication between the front end computers 18a- 18b and any network entity for which a write command message may be recognized In accordance 5 with this validation method, the front end computer 18 will send a contract offer message on a periodic basis to the Ethernet address of each host entities on the network 20 which it recognizes as having a write message capability Each of these contract offer messages will include a random or pseudo-random number or other suitably unpredicable message component In orαer for a nost entity to aole to nave its write command messages recognized, t must respond to its contract oτfer message within a predetermined period of time (tor example, 10 seconds) with a contract acceptance message that includes a transformed version oτ this unpredicable message component While any appropriate encryption algorithm be used for this purpose, it is preferred that this encryption algorithm be different than the encryption algorithm used to validate the transfer of a security table from the security server 68 Additionally, it should be noted that tne security message protocol may oe used for these contract offer and acceptable messages

The front enα comouter 18 will then decrypt the random number embedded in the contract acceptance message to determine if a time limited communication contract will be established between the front end computer and this host entity at the specific Ethernet address for the host entity that was contained in the security table This time limited communication contract will ensure that a write command message link between a front end comouter 18 and a particular host entity will be reliable and specific Thus, for example, the front end computer 18a will send a contract offer message to the Ethernet address of the operator workstation 72 which will contain a new random number (for example, 32 bits in length) The operator workstation 72 will respond with a contract acceptance message that includes an encrypted version of this particular random number Then, the front end computer 18a will either decrypt this number with the contract algorithm key stored in its memory for this purpose or use the same encryption algorithm to compare the offer and acceptance numbers If these numbers match, then the front end computer 18a will be process write command messages from the operator workstation 72 for a predetermined period of time. Otherwise, if the numbers do not match, fhen the front end computer 18a will disable a write command authorization bit for the Ethernet address of the operator workstation 72 from its security table S1 to indicate that write command messages from this operator workstation should be ignored

The communication contract established for write command messages is time limited to enhance the transmission security of these particular messages. In the preferred embodiment, the communication contract will automatically expire within twenty seconds after Deing initiated Nevertheless, in order to ensure that the ability to send write command messages is not interrupted, the contract offer messages should be sent from the front end computer 18 to each of the appropriate host entities on the network 20 on a periodic basis which will provide this continuity For example, with a communication contract of twenty seconds, it is preferred that the contract offers be transmitted at a rate of approximately every ten seconds. In other words, every ten seconds, each of the host entities that are capable of transmitting recognizable write command messages will receive a new random number from each of the front end computers 18 In the event that a host entitv fails to respond to a contract offer message from a front end computer 18, the front end computer will preferably make tnree tries to establish or maintain a time limited communication contract If no response is received from these three tries, then the the front eno comouter 18 will disable the write command authorization bit for the Ethernet address of this host entity from its security table In such an event, the affected host entity will not be able to have its write command messages processed by the front end computer 18 until the security server 68 transmits a new security table to the front end computer 18.

It should be appreciated from the above that only the random numbers need to o be encrypted to facilitate a transfer of the security table or to establish the time limited communication contract for write command messages. However, it should be understood that the security table itself or the write command messages could be encrypted as well in the appropriate application. Nevertheless, the use of different Ethernet protocols for security messages and write command messages, the use of different encryption algorithms for security 5 table transfers and write command communication contracts, the limitation of the time of the write command communication contracts to short durations, and the use of specific permissive tables for each of the front end computers 18, all combine to provide a very high degree of communication and write command security for the process control computers 12a- 12b. Additional protection is also substantially provided by the guardian circuit in the stealth 0 interface circuit 16, the embedding of a program version identifier in the PL and PR permissive tables, and the encryption of the these program version identifiers by the front end computers 18a- 18b when a verified write command message is transmitted to the process control computer 12a-12b. In this regard, it should be noted that the encryption algorithm used by the front end computers 18a- 18b for the program version identifiers is preferably different than 5 the encryption algorithm used for security table transfers or the encryption algorithm used to establish the time limited communication contracts for write command messages.

Turning to Figure 3, a block diagram of the stealth interface circuit 16 is shown. Reference will also be made to the schematic diagram of the stealth interface circuit 16,whιch is shown in Figures 4A-4B. The stealth interface circuit 16 is interposed between the internal bus 0 structure 100 of the process control computer 12 and the externally directed stealth port 102. The stealth interface circuit 16 is connected to bus structure 100 via a set of suitable buffers. In this regard, buffer block 104 includes two 8-bιt buffer circuits U 17- U 18, which receive address information from the address bus on the process control computer 12 Similarly, buffer block 106 includes two 8-bιt buffer circuits U6-U7, which receive data information from the data bus 5 of the process control computer 12

The stealth interface circuit 16 also includes a data control block 108, which is also connected to the bus structure 100 of the process control computer 12 As indicated in Figure 4A, the data control block 108 is preferably comprised of a Programmable Array Logic "PAL" circuit U 1 5 (for example, EP512) wnich is used to detect the SDSS and DSS signals from the process control comouter 12 As well known in the art, a PAL circuit has fusible links which may oe programmed so tnat a plurality of internal AND gates and OR gates will be configured to oerrormed a desired logic Tunction While a PAL circuit provides a relatively low cost way of implementing logic functions, it should be understood that other suitable circuit devices may oe used for this application It should also be noted that the PAL circuit is programmed to detect two extra strobe signals that may be generated by the process control computer 12, namely the "EXS1 " and " EXS2 ' signals One or both of these extra strobe signals may be used oy the process control computer 12 to indicate that certain data stored in the dual-ported data memory 22 is stable, sucn as data used to display graphical information

The stealth interface circuit 16 also receives four control signals from the process control computer 12 which are used to access the dual-ported data memory 22 These signals are "/EN_DATAMEM", "/EMR" , " R/W" and "MEMCLK The first three of these signals relate to whether the process control computer 12 seeks to read or write to the dual-ported data 5 memory 22 However, MEMCLK is the memory clock signal referred to aoove which effeαively divides the time in the machine cycle of the process control 12 available for accessing the dual- ported data memory 22 The MEMCLK signal is a fifty percent duty clock signal, as shown in the timing diagram of Figure 5A In accordance with the method illustrated in this timing diagram, the dual-ported data memory 22 may be accessed from the internal process control computer o port 100 when MEMCLK is Low Then, when MEMCLK undergoes a transition to a High state, the dual- ported data memory 22 may be accessed from the external stealth port 102. While the MEMCLK signal is shown to have a period of 400 nano-seconds (that is, a frequency 2.5 MHz), it should be understood that other suitable periods and duty cycles may be provided in the appropriate application 5 On the stealth port side of the stealth interface circuit 16, a set of suitable buffers are also provided to handle the transfer of address and data information In this regard, buffer block 1 10 includes two 8-bιt buffer circuits U 1-U2, which receive address information from the external stealth port 102 Similarly, buffer block 1 12 includes two 8-bιt buffer circuits U4-U5, which are capable of transmitting and receiving data information between the dual-ported 0 data memory 22 and the stealth port 102

Additionally, the stealth interface circuit 16 includes a arbitration circuit 1 14 which receives bus request signals from external entities on the stealth port 102 As shown in Figure 5B, the present embodiment provides four individual channel lines for the incoming bus request signals "/BR1. /BR4" Thus, the stealth interface circuit 16 enables up to four different 5 external entities to be connected to the stealth port 102 The arbitration circuit 1 14 is shown in Figure 4B to comprise a four input asynchronous bus arbiter circuit U9 which will grant bus access to the first bus request signal received In this regard, a specific bus grant signal 7BG 1. /BG4" will ultimately be generated to inform the particular external entity who won the DUS that the channel is clear for its use The arbitration circuit 1 14 also nas an internal AND gate which will oroduce the any-ous-request signal ' /ANY BR" shown in the timing diagram of Figure 5A

The stealth interface circuit 16 furtner includes a stealth oort control circuit 1 16, which is used to control access to the dual-ported data memory 22. The control circuit 1 16 is shown in Figures 4A-4B to comoπse a PAL circuit U 16, a timer circuit U 10 and a set of tπ-state buffers which are contained in chip U8. In the case o'f memory access for the internal process control computer bus 100, the PAL circuit U 16 will transmit the chip select signal "/CS" to the buffers 104 and 106 to latch or capture address and data information from the internal bus. The PAL circuit U 16 will also send the enable memory read signal "/B EMR" to the buffer 106 when the process control computer 12 needs to latch or capture data from the data bus 1 18 of the stealth interface circuit 16. In this regard, the PAL circuit U 16 is responsive to both the MEMCLK signal and the central process unit clock signal "CP" of the process control computer 12. In the case of memory access from the external stealth port 102, the PAL circuit

U 16 will transmit the enable signal "/SP EN" to the buffers 1 10 and 1 12 to latch or capture address and data information from the external bus. The PAL circuit U 16 will also send the enable memory read signal "SW/R" to the buffer 1 12 when an external entity is permitted to latch or capture data from the data bus 1 18 of the stealth interface circuit 16 The SW/R signal is received at the stealth port bus 102, and it provides an indication from the external entity the direction of data flow desired. In this particular embodiment, the SR/W signal is active High for a read cycle and active Low for a write cycle. The SR/W signal is common to all four potential external users, and it should be held in a tπ-state until the external user winning the bus receives its active Low /BR signal. The PAL U 16 also transmits the SW/R signal to the check point guardian circuit 120

(PAL circuit U 13) to initiate an evaluation to be made on the address of the dual-ported data memory 22 selected by the external entity for a write operation. In this regard, the guardian circuit 120 is programmed to inhibit the transition needed in the chip enable signal 7CE" for accessing the dual- Dorted data memory chips U 1 1 -U 14, whenever the address is outside of the mailbox section 26.

With respect to the sequence of oDeration for tne stealth interface circuit 16, it should be appreciated that a memory read/write cycle from the stealth port 102 must be initiated by the external entity seeking to access the dual-ported data memory 22. This cycle is begun with the transmission of a bus request signal /BR from the external entity, such as front end computer 18a. Upon the receipt of any bus request signals, the arbitrator circuit 1 14 will transmit an active Low any-bus-request signal /ANY BR to the PAL circuit U 16. The any-bus- request signal is directed to an internal flip-flop of the PAL circuit U 16, which operates under the clock signal CP. Accordingly, the any-bus- request signal needs to be present before the -ailing edge of the ciock signal CP in order for stealth port access to occur when MEMCLK goes πgn, as shown in the timing αiagram oτ Figure 5A If the latched any-bus-request signal is active, the stealth interface circuit 16 will begin a stealth port memory cycle Otherwise, the stealth interface circuit 16 win not initiate a stealth port memory cycle until the next MEMCLK signal period

When a stealth port memory cycle occurs, the /SP EN signal is generated from tne PAL circuit U 16 As indicated above, tnis signal will enable the address and data buffers on the stealth port The /SP EN signal will also enable the arbitration circuit 1 14, which issues a specific bus grant signal /BG for the external user which wins the bus Once the external entity o detects its bus grant signal, then it may transmit either the memory address it seeks to read or the address and data necessary for a write operation The chip enable signal /CE is delayed by the PAL circuit U 13 to allow for the delay introduced from the address buffer 1 10, as the address needs to be stable before the RAM chips U 1 1- U 14 are actually accessed

For a stealth port read cycle, the data placed on the data bus 1 18 will become

- 5 stable approximately 45ns alter /CE becomes active In this regard, it should be noted that symbols such as "TCE" in the timing diagram of Figure 5B, indicate the appropriate delay time duration A read latch signal RDLATCH directed to the PAL circuit U 16 may then be used by the external entity to either latch the data into the buffer 1 12 or indicate that data is available. For a stealth port write cycle, the aαdress lines on the address bus 122 will be monitored by the 0 guardian circuit 120 to ultimately permit or deny write access to the stealth port 102 When write access is denied, the guardian circuit will not generate the active Low chip enable signal /CE, and thereby restrict an external entity on the stealth port 102 from writing to the particular address location in the dual-ported data memory 22 that it has selected In this event, the guardian circuit 120 will also generate a write address valid signal "WR AD VAL",

25 which is transmitted to the PAL circuit U 16 of the control circuit 1 16 The PAL circuit U 16 will respond by generating a write address error signal "WR AD ERR" for transmission to the external entity The write aαdress error signal is active High and valid only during the current memory access cycle, and this signal is common to all external entities

For stealth port accesses to valid write addresses, the guardian circuit 120 will

30 activate the /CE signal Additionally, the SR/W signal from the external entity should become active when the bus grant signal /BG is Low The PAL U 16 will also cause the write enable signal /WE for the RAM chips U 1 1-U 14 of the dual-ported data memory 22 to become active, and the rising edge of the /WE signal is used to write data into these RAM chips

The control circuit 1 16 also includes a timer circuit U 10, which will generate a

35 CLEAR signal approximately 150ns after one of the bus grant signals /BG becomes active The CLEAR signal is used to cause the tπ-state buffers in buffer chip U8 to generate individual bus grant clear signals "BG 1 CLR .BG4 CLR" to each external user The CLEAR signal is also used to clear the stealth port memory cycle by deactivating the stealth port enable signal /SP EN Referring to Figures 6A-6E, a set of flow charts is shown to furtner illustrate various aspects of the security and validation methods discussed above In this regard, Figure 6A shows the part of the boot up procedure of the front end computer 18 which is directed to a search for the security server 68 Then, once the security server nas properly identified itself to the front end computer 18, Figure 6B shows the orocedure for transferring the security table (for example, security table 51 ) Thereafter, Figure 6C shows the procedure for establishing a time limited communication contract with each of the operator stations identified in the security table as having write command ability Finally, Figures 6D-6E combine to illustrate the procedure for validating a write command message sent from an operator station (for o example, operator station 72)

Turning first to Figure 6A, block 200 indicates that the front end computer " FEC" sends a broadcast message over the computer network 20 to request that the security server 68 identify itself to this front end computer This message preferably utilizes the Ethernet protocol for security messages The content of this broadcast network message is generally 5 shown in block 202 In this regard, the network message includes a destination address "FF-FF- FF- FF-FF-FF" which will cause the message to be sent to every entity that is operatively coupled to the PAN-1 and PAN-2 segments of the computer network 20. The network message also includes the source address of the front end computer The network message also includes a type indication, namely " REQUE5T_SECURITY_SERVER" In the data portion of the network 0 message, the CPU identification is given for the process control computer 12 to which the front end computer 18 is connected Additionally, and importantly, the data portion of the network message also includes an unpredicable key, such as a 32 bit random number. As discussed above, this random key is used to verify the identity of the security server 68

Block 204 shows that the security server 68 will check all of the information in the 5 broadcast network message, sucn as the physical Ethernet address of the front end computer and the CPU ID of its process control computer 12. Assuming that this information corresponds to the information stored in the security server for this front end computer, an acknowledgement message 206 will be sent back to the physical Ethernet address of the front end computer In order to enable the front end computer to verify the identity of the security 0 server 68, the acknowledgement message 206 includes a transformation of the random key sent from the front end computer 18 As indicated above, this transformation is performed with an encryption algorithm which is unique to messages from the security server 68

Diamond 208 shows that the front end computer 18 will wait a predetermined amount of time to receive the acknowledgement message. If the acknowledgement message is 5 not received within this timeout perrod, then the front end computer will use the last security table stored in its memory or the default security table if this is the first time the front end computer 18 is being brought into operation (block 210). However, if the acknowledgement message 206 is received in time, then the front end computer 18 will check its random key against the transformed version of the key wnich was contained in the acknowledgement message (block 212). As indicated above, this comparison may be accomplished by either performing a transformation on the random key using the encryption algorithm for security messages or using a corresponding decryption algorithm If the transformed key matches the expected key number (diamond 214), then the front end computer 18 will proceed to the procedure shown in Figure 6B for transferring a copy of the current security table from the security server 68 (block 216). Otherwise, the front end computer will exit this portion of the boot up procedure and stop accumulating further network communication capability (block 218) In one form of the present invention, the front end computer 18 may be permitted to o conduct network communications at this point, but not process any write command messages received from an entity on the computer network 20, until such time as a security table is successfully transferred to the front end computer

Turning now to Figure 6B, block 220 shows that the front end computer 18 starts the procedure for transferring a cooy of the security table by sending a request message to the 5 specific (logical or physical) Ethernet address of the security server 68. This physical Ethernet address is the address learned and stored through the boot up procedure discussed above in connection with Figure 6A. Block 222 indicates that this request message includes an identification of the CPU ID for the process control computer being serviced by the front end computer 18. Additionally, the front end computer 18 will also inform the security server 68 as 0 to wnether this CPU ID is for the Left process control computer 12a or the Right process control computer 12b through the Mode data (for example, ML for the Left process control computer).

Once the security server receives this request message, it will check the data contained in the message, and build a control message for the front end computer 18 (block 224) As shown in block 226, this control message will inform the front end computer 18 how 5 many bytes are contained in the security table for the process control computer identified in the request message. The front end computer 18 will respond with an acknowledgement message that will contain a new random key (blocks 228-230). The security server will then transmit the security table (for example, secuπty table S 1 for the Left process control computer 12a) with the transformed random key (blocks 232-234). The front end computer 18 will then 0 determine if the transformed key matches the expected key (diamond 236). If the keys do not match, then the front end computer 18 will use the old or existing security table stored in its memory (block 238). Otherwise, the front end computer 18 will store the new security table for use, and senα an acknowledgement message back to the security server (blocks 240-244). While the front end computer 18 could also be provided with the editing capability to create its 5 own security table, it is preferreα that a separate network security server be employed in order that the front end computer be dedicated to the functions identified above.

Referring to Figure 6C, the procedure for establishing a time limited communication contract is shown. The front end computer 18 begins by creating a new watch- oog key, wnich is represented bv a 32 bit random numoer (block 246) The front end computer 18 will then send a watch-dog message in turn to tne physical Ethernet address of each of the operator stations (identified in the security table as having write command message capability) In this regard, it should oe aboreciated that these are individual watch-dog messages which include a new watch-dog key for eacn message (block 248) Each operator station which receives such a watch-dog message will respond with a watch-dog reply message that includes a transformation of the watch-dog key (blocks 250-252)

Since it is possible that an operator station may not currently be in communication with the computer network 20, the front end computer 18 will preferably wait for a suitable timeout period for a reply, such as ten seconds (diamond 254) If the operator station does not reply to the watch-dog request message 248 within this timeout period, the front end computer 18 will make additional attempts to make contact (diamond 256 and block 258) If a reply is not received from this operator station after all of these attempts, then the front end computer 18 will disable the write command ability of this particular operator station (block 260) However, it should be appreciated that this write command ability may subsequently be re-established, sucn as wnen an updated security table is transferred to the front end computer 18 In this regard, it should be noted that the security server 68 may initiate the security table transfer procedure discussed above through a suitable network message to the front end computer 18. I the event that the operator station does reply to the watch-dog request message, then the front end computer 18 will determine whether the transformed watch-dog key contained in the reply message matches the expected key number (diamond 262). If a match is not found through this comparison (as discussed above), then the front end computer 18 will ignore the reply message (264) At this point, the front end computer 18 could again attempt to establish a time limited communication contract with this operator station or disable its write command abilities. In the event that a match was found, then the front end computer 18 will copy the previous, valid watch-dog key of this operator station from the current key position to the old key position (block 266) Then, the front end computer 18 will save the transformed watch-dog key received in the reply message in the current key position. As will be discussed below, the current and old keys are used to evaluate the validity of write command messages from the operator station during the period in which a time limited communication contract is in force. In this regard, it should be understood that the procedure shown in Figure 6C is repeated for each of the operator stations with write command privileges before the time limited communication contract expires in order to maintain a continuous ability of the operator stations to have their write command messages processed by the front end comouter 18

Referring to Figures 6D-6E, these figures combine to illustrate the procedure for validating a write command message sent from an operator station (for example, operator station 72) to the τront eno computer 18 This oroceoure Degms witn an ooeratpr station sending a write command message to tne front eno comouter 18 (block 268) Tnis message oreτerabiy utilizes the standard Ethernet protocol for communication between the front end comouter 18 and other entities on the computer network 20 In this regard, tne write command message will include not only the varιable(s) sought to changed, but also the watch¬ dog key from the time limited communication contract, the CPU identification of the recipient process control computer, and the program version identification of this process control computer 12 The front end computer 18 will then perform several checks on this write command message For example, the front end computer 18 will examine the security tabie to

• o determine if it has an entry for this particular operator station (diamond 270) If this operator station was not found in the security table, then the front end computer will return the write command message to the operator station and create a stored log of this error (block 272).

Assuming that the operator station was identified in the security table, then the front eno computer will check the security table to determine if the write command bit was set

15 for this operator station (diamond 274) At this ooint, it should be understood that the security table contains not only the Ethernet address of every valid entity on the computer network 20 who can communicate with the front end computer, but also an indication of whether these entities have write command privileges The security table may contain additional information pertaining to each of these entities, such as a CPU identification and whether or not these

20 entities may request specific types of information from the process control computer, such as alarm messages. If the security table does not have the bit set to indicate write command privileges, then the front end computer will return the write command message to the operator station (or other source entity), and log this error (block 276).

In the event that the operator station does have write command privileges, then

25 the front end computer will determine whether or not the watch- dog key (contained in the write command message) matches either the current or old watch-αog keys (diamond 278). If a match is not found, then the front end computer will return an invalid watch-dog message to the operator station (block 280). If a match was found, then the front end computer will preferably check to see if the program version identification contained in the write command

30 message matches the program version identification stored in the front end computer for the recipient process control computer 12 (diamond 282) If these program version identifications do not match, then the front end comouter will return an invalid program version message to the operator station (block 284).

The front end computer 18 will also check to see if the write command message

35 contains an indication that the permissive table for the recipient process control computer should be bypassed (diamond 286) The ability to bypass the permissive table may be considered a special privilege which should require the use of a password or physical key which is assigned to the operator with this privilege. If the bypass bit was set in the write command message, then the front end comouter will still oreferably creek the permissive table (for example, permissive table 80a) to determine if a bypass is permitted for the specific permissive table or table section that would otherwise oe addressed (diamond 288) If a bypass of this oermissive table is not permitted, then the front end computer will return a message to the oDerator station to indicate that no write access is available in this way (block 290) If a bypass of the permissive table is permitted, then the front end comouter will transmit the write command message to the reciDient process control computer with a transformed version of the program version identification stored in the permissive table of the front end computer (block 292) The recipient process control comouter 12 may then determine whether this transformed o program version identification matches the program version identification of its operating program before deciding to change the vaπable(s) iisted in the write command message.

In the event that the write command message does not have the bypass bit set, then the front end computer 18 will examine the permissive table to determine if the the vaπable(s) to be changed have their write command bit set (diamond 294) If the write 5 command bit is not set for any one of these variables, then the front end computer will return a no write access message to the operator station (block 296) Otherwise, if the front end computer determines that the write command message is acceptable, then it will transmit the message to the recipient process control computer as discussed above (block 292).

Referring to Figure 7, a block diagram of the application software 300 for the 0 front end computer 18 is shown In this regard, Figure 7 shows the interaction of the application software with the Q-bus 302 of the front end computer 18 and with the Ethernet services 304 for the computer network 20 Thus, for example, a bi-directional line is provided between the Q-bus 302 and the IFQ driver 308 The IFQ driver 308 represents the device driver software for controlling the communicating with the CPU of the front end computer 18. The

25 IFQ driver 308 is coupled to the "Ml Sync" subsystem 310 through a data store event 312 In this regard, the Ml Sync subsystem receives notification of DMA completions from the IFQ driver 308, such as when the SDSS data from one of the process control computers 12a- 12b has been completely received in the appropriate Interim buffer (for example, Interim buffer 46a or 48b) The reflective memories 46a-56a from Figure 1 are shown in Figure 7 as reflective memories

30 314 Figure 7 also illustrates that the reflective memories 314 are operatively coupled to the Q- ous 302 of the front end computer 18

The Ml Sync subsystem 310 represents that portion of the application software 300 which is responsible for synchronizing the incoming SDSS and DSS data frames from each of the process control computers 12a- 12b through the operation of the reflective memories 314,

35 as discussed above. The Ml Sync subsystem also notifies the " Ml MOD Health" module 316 and "System Messages" module 318 when a data frame is available for processing Additionally, the Ml Sync subsystem 310 is also used to detect whether or not reflective memory updates are not occurring, such as when one of the process control computers has stopped sending data to tne front eno computer 18 This procedure is implemented through the "MOD Status ' module 320 and the "Ml Watchdog ' module 322. The Ml Watchdog module 322 uses a two-second timer to detect if the front end comouter 18 has stopped receiving data from either of the process control comouters 12a-12b The Ml MOD Health module 316 processes health bit changes in the data being received by the front end computer 18 from the process control computers 12a- 12b. In this regard, the Ml MOD Health module 316 sends these changes to the " EVT Event Handler" module 324. Similarly, the Ml System Messages module 318 processes incoming system messages from the process control computers, and it queues any requests to the EVT Event o Handler module 324 The EVT Event Handler module 324 processes event buffers, formats text for output to the Print Services module 326, and records errors and other events in an event log

The reflective memories 314 are coupled to the "Ml CISS Memory Read " module 328, which performs read operations on the reflective memories In this regard, the Ml CISS 5 Memory Read module 328 formats αuery responses into the standard Ethernet protocol for transferring data/messages, and directs the response to the requesting network entity via port 330. The "Nl CISS" module 332 receives incoming query requests from a network entity using the standard protocol for transferring data/messages. The Nl CISS module 332 performs an initial security check on the message, and routes the request to the appropriate process es 0 determined by the message type For example, the Nl CISS module 332 will route a read data message to the Ml CISS Memory Read module 328. Additionally, the Nl CISS module 332 will route program download requests to the "Ml Download Handler" module 334. Other request messages will be routed to the "Ml Message Services" module 334.

The application software 300 also includes modules which facilitate 5 communication with a User Interface In this regard, the User Interface is used to provide a window into the operation of the front end computer 18, as opposed to an interface to one of the process control computers 12a-12b. The User Interface software may be accessed "locally" through a terminal connected directly to the front end computer 18 The User Interface software may also be accessed "remotely" through an application that could be run from the 0 security server 68 The User Interface is used to disable or re-enable network communications for a specific protocol, perform diagnostic functions, re-boot the front end computer 18, monitor reflective memory updates, monitor network activity, and otherwise manage access to privileged front end computer functions.

The application software modules that handle User Interface requests are the "Nl 5 Remote User" module 338, the " Ul Local" module 340 and the " Ul Services" module 342. The Nl Remote User module 338 receives all messages having the protocol for User Interface communications, and it forwards valid requests to the Ul Services module 342. The Ul Services module 342 provides a data server for both local and remote user requests. The U I Local ^■nodule 340 handles tne local User interface display screens in order to oisolay responses on the 'ocal terminal.

The aopiication software 300 also includes an " Nl Transmit Done" module 344, wnicn receives notification of Ethernet-write completions and maintains a free queue of network interface transmit message buffers. Additionally, an " EVT File Maiπt" module 346 is used to delete aged event log files. Furthermore, an " Nl Watchdog" module 348 and an " Nl SCSP" module 350 to implement the watchdog security process discussed above. In this regard, the Nl Watchdog module 348 sends watchdog request messages to the operator stations, and the Nl SCSP module 350 processes the reply messages (as well as all other network messages

10 using the security protocol). The Nl Watchdog module 348 also checks to see if reply messages were received to each of the watchdog request messages.

Other than watchdog reply messages, the Nl SCSP module 350 forwards all other security protocol messages to the "CFG Config Manager" module 352. The CFG Config Manager module 352 processes the security requests and performs the initial loading of the

15 permissive tables 80a-82a. The CFG Config Manager module 352 also performs the loading of a memory map to be discussed below in connection with Figure 8. The application software 300 also includes a "MIF Master Process" module 354, which performs the basic initialization routines to create all of the other front end computer processes. The MIF Master Process module 354 is also used to detect an unexpected termination of any of these processes.

20 Referring to Figure 8, a diagrammatic illustration of the configuration for the front end computer 18a is shown. Specifically, Figure 8 illustrates that the CFG Config Manager module 352 interacts with the security server 68 and the download assistant 78 to obtain the information necessary to configure the front end computer 18a on boot up. In this regard, the CFG Config Manager module 352 is responsive to requests from the MIF Master Process module

25 354 to perform these configuration activities. In other words, the CFG Config Manager module 352 will locate the security server 68 through the broadcast network message (as described above) and load the security table SI which is ultimately received from the security server. Additionally, the CFG Config Manager module 352 will also load both of the permissive tables 80a-82a from the download assistant 78. The CFG Config Manager module 352 also receives a

30 memory map for each of the process control computers 12a-12b, such as the memory map 356 shown in Figure 8 The memory maps are used to enable the front end computer 18a to build the transfer tables (for example, transfer table 37) and interpret the data received in each of the reflective memory buffers 314. In other words, each of the memory maps identify the data which is stored in each addressable location of the dual-ported data memory 22 for each of the

35 process control computers 12a-12b. As part of this process, the memory map divides the dual- ported data memory 22 of the process control computer 12 into logical segments. The first set of segments are used for SDSS data values, while the DSS data values include the SDSS memory segments, as well as additional segments. As discussed aoove, the Ml Sync subsystem 310 is resDonsible for grouomg the DMA comoletion events relative to the transfer of SDSS and DSS data for both process control comouters 12a- 12b into a cohesive Dair of data tables that reoresent data for a given process control cycle snap-snot ^For purposes of this discussion these DMA completion events will be referred to as the Left SDSS buffer, the Right SDSS buffer, the Left DSS buffer and the Right DSS buffer The exact order in wnich these data buffers are received may vary, but the SDSS buffers will precede the DSS buffers

The MI Svnc suPsystem 310 is responsive to the above identified DMA events In tms regard, the Ml Sync subsystem 310 will wait for the completion of a DMA event, and then o check the status to determine the type of buffer received If the buffer received is an SDSS buffer and the front end computer 18 has already received a corresponding DSS buffer, then final completion processing will be performed Likewise, if the buffer for this type has already oeen received, final completion processing will be performed If the buffer received is not the first buffer, then the Ml Sync subsystem 310 will check the time difference between the current 5 time and the time at which the first buffer was received If this difference exceeds a predetermined tolerance, sucn as 0 7 seconds, then the steps for final completion processing will be performed If this is the first buffer (for example, the Left SDSS buffer), then the time that this buffer was received will be recorded If this buffer was not expected at this point, then its status will be changed to expected The pointer to this buffer will also be recorded, 0 and the buffer will be marked as received

The Ml Sync subsystem 310 will also check to see if all expected buffers have been received (for example, the Left Right SDSS and Left/Right DSS buffers) If all the expected buffers have been received, then final completion processing will be performed During final completion processing, the buffer pointers for the received buffers will be copied to a system 5 αata structure which will allow other applications to access this data This procedure is protected by a mutual exclusion semaphore, which is referred to as the "mutex" Additionally, the error counters will be zeroed for all received buffers If any expected buffers were not received, the associated error counters will be incremented If the error counters exceed the allowed threshold, then the affected buffers will be marked as not expected Then all buffers 0 will be marked as not received in order to set up the processing for the next set of buffers

Applications that access the memory buffers received may then copy the buffer pointers out of the shared system data structure for use

In order to more fully illustrate the operation of the Ml Sync subsystem 310, a module synopsis and the pseudo-code for this software will be presented below Additionally, 5 the data structures for the reflective memory buffers 314 will also be set forth as well to assist the interpretation of tne oseudo-code The data structures are contained in Tables 1-3, the module synopsis is contained in Table 4, and the pseudo-code follows immediately thereafter

RM_ MUTEX Mutex Mutex used to protect this data structure

RM_ STATUS Word Indicates current reflective memory status

LEFT_SDSS_PTR Pointer Pointer to current left SDSS reflective memory buffer

RIGHT_SDSS_PTR Pointer Pointer to current right SDSS reflective memory buffer

L≡FT_DSS_PTR Pointer Pointer to current left DSS reflective memory buffer

RIGHT_DSS_PTR Pointer Pointer to current right DSS reflective memory buffer

FOX_DSS_PTR Pointer Pointer to current fox DSS reflective memory buffer

DOG_DSS_PTR Pointer Pointer to current dog DSS reflective memory buffer

FOX MAP PTR - Pointer Pointer to current memory map (left or right) for the current fox buffer

DOG MAP PTR Pointer Pointer to current memory map (left or right) for the current dog buffer

Indicates the channel that is the fox. 0 = left, 1 = right,

-1 = undefined.

Indicates the channel that is the dog. 0 = left, 1 = right,

-1 = undefined.

Info byte for outbound CISS requests satisfied from the left buffer. Includes fox/dog status.

Info byte for outbound CISS requests satisfied from the right buffer. Includes fox dog stat

Info byte for outbound CISS requests satisfied from the fox buffer. Includes left/right status.

Info byte for outbound CISS requests satisfied from the dog buffer. Includes left/right status.

NOTE: The Reflective Memory Buffer Management Structure (Ml RMBMS) array consists of four MI_RMB_STATUS_TYPE (define below data structures). Each RMBMS entry is used to keep track of a specific ^ref iective memory type (left/right SDSS and DSS). Symbolic indices are defined to access this array: Ml RM_L_SDSS,

VII RM R SDSS, Ml RM L DSS, and Ml RM D DSS.

LAST RECEIVED Time Specifies the time of receipt of the last buffer for this type-

DMA EVENT Object Contains the VAXELN object ID for the event signaled

Variable by IFQ Driver when a DMA completion for this type of memory buffer completes.

ENABLE EVENT Object Contains the VAXELN object ID for the event signaled

Variable by calling MI_ENABLE_STROBES to tell Ml Sync that strobes have been enabled.

DISABLE EVENT Object Contains the VAXELN object ID for the eventsignaled by

Variable IFQ Driver when a DMA completions for this type of memory by calling MI_DISABLE_STROBES to tell Ml

Sync that strobes have been disabled.

PEND BUFF PTR Pointer Contains a pointer to the DMA buffer received for this memory type in the current time window. Reset to null by Ml Sync upon copying pointers to Ml RM DATA.

RMB_STS Longword Longword bit masks indicating the status of this reflective memory buffer. The individual bit fields are listed below.

RMB_STS__V Bit Bit in RMB_STS that indicated that EXPECTED the associated strobe for this reflective memory type is enabled, thus indicating that DMA completions are expected.

RMB_STS_V_ Bit Bit in RMB_STS used by Ml Sync RECEIVED to indicate that a DMA completion for this reflective memory type has occurred in the current DMA time window Cleared wnenever a complete set of buffers has been received, and then set for each individual buffer type as it is received

RMB_STS_V_ Bit Ml Sync to indicate that a DMA

DSS BUFF completion for this reflective memory type has occurred in the current DMA time window Cleared whenever a complete set of buffers has been received, and then set for each individual buffer type as it is received Indicates if the reflective buffer type in question is either for the left or right DSS reflective memory buffer

RMB_STS_ V_ Bit Indicates if the associated strobe

ENABLE1 is enabled

CONS ERR COUNT Longword Specifies the number of consecutive receive failures for this buffer type.

DMA ERR COUNT Longword Specifies the number of consecutive DMA completion failures for this buffer type

ADSB Structure Specifies the Asynchronous Data Status Block used by the drive to indicated DMA completion status This structure is of the IFQ$ ADSB type and includes a status field and a buffer number field

BUFFER PTR Pointer The BUFFER PTR array the addresses of up to eight

Array[8] DMA buffers used for this reflective memory type, in the order the buffers where specified in the IFQ$_ENABLE_DSS or SDSS call This array is subscripted by the buffer number field returned in the ADSB to retrieve the base aαdress of the DMA buffer just received. This dimension of this array allows for the maximum numoer of DMA buffers supported by the IFQ driver.

BUFF HIST IDX Longword Index to the BUFF HIST PTR array. Indicates the most recently updates buffer.

BUFF HIST PTR Pointer Circular buffer of most recently received buffers. DMA

Array(8] Indicates the buffers received in the last eight seconds. BUFF HIST IDX points to the most recent entry.

MOD TASK Longword Indicates the PCC task state as indicated by the most recent reflective memory update. Valid only if RMB STS V DSS BUFF is set.

TABLE 3: Reflective Memory Data Structures

Data Item Data Format Description

Data Structure Ml RM AUX

LAST DSS L PTR Pointer Pointer to most recent left DSS buffer. Set by Ml Sync and used by Ml Health Check and Ml System Messages.

LAST DSS R PTR Pointer Pointer to most recent right DSS buffer. Set by Ml Sync and used by Ml Health Check and Ml System Messages.

WD FLAG Longword Flag used by Ml Sync and Ml Watchdog to check for Ml Sync activity.

DMA_BUFFER_ Longword Specifies the number of DMA buffers currently in use. COUNT Copied from MIF_MP.NUM_DMA_BUFFERS on startup.

TIME CHANGE Event Set when a time change occurs. Tells Ml Sync tore-

Object determine the time of the first DMA receipt. SYSMSG L SEMA Semaohore Set by Ml Sync to trigger Ml System Messages to

Object process left reflective memory.

SYSMGR_R SEMA Semaohore Set by Ml Sync to trigger Ml System Messages to

Object process right reflective memory.

HEALTH L SEMA Semaphore Set by Ml Sync to trigger Ml Health Check to process

Object process left reflective memory.

HEALTH R SEMA Semaphore Set by Ml Sync to trigger Ml Health Check to process

Object right reflective memory.

ABSTRACT Synchronizes receipt of in-incoming DMA buffers

MODULE TYPE Process mainline

EVENTS/ MI_RMBMS(*). The four (left/right DSS/SDSS) completion SEMAPHORES EVENT events signaled by the IFQ DMA Driver process on receipt of a new reflective memory buffer. Indices to the MI_RMBMS array are M1_RM_L_DSS, MI_RM_R_DSS, MI_RM_L_SDSS and Ml RM R SDSS.

MI_RMBMS(*). The four (left/right DSS/SDSS) DMA enable ENABLE_ events. These are signaled by MI_ENABLE_

EVENT STROBES to notify Ml Sync of changes in the receipt of SDSS and DSS DMA uodates.

MI_RM8MS(*). The four (left/right DSS/SDSS) DMA disable DISABLE events. These are signaled by Ml DISABLE EVENT STROBES to notify Ml Sync of changes in the receipt of SDSS and DSS DMA updates.

MI_RM_AUX_ Signaled to tell Ml MOD Health to process left

HEALTH_L health bits.

SEMA

MI_RM_AUX_ Signaled to tell Ml MOD Health to process

HEALTH_R_ right health bits.

SEMA

MI_TM_AUX Signaled to tell Ml System Messages to process

SYSMSG L left system messages.

SEMA

MI_TM_AUX_ Signaled to tell Ml MOD Health to process

SYSMSG R right system messages.

SEMA

OTHER INPUTS MI_RMBMS(*). Asyncronous Data Status Blocks for each of the ADSB four DMA completion events.

DSS data buffer Accessed at offset MI_TASK_STATE_L or

MI_TASK_STATE_R to determine FOX/DOG status.

OTHER OUTPUTS Ml RM DATA Structure containing current reflective memory pointers.

MI_RM_AUX. Set to 1 to indicate receipt of data. WD FLAG

CALLED KERSWAIT_ANY ROUTINES

KERSCLEAR_EVENT KER$LOCK_MUTEX KERSUNLOCK_MUTEX

CONDITION MIF_NORMAL CODES MIF_IFQ_ERROR

MIF APP ERROR

MI_SYNC_MAIN Pseudo-code

PROGRAM MI_SYNC_MAIN

waiting for first DMA = true

REPEAT

/* Issue the wait any for the four DMA completion events, the an enable or disable of strobes, or time changes: */

CALL KERSWAIT_ANY with MI_RMBMS[0].DMA_EVENT,

MI_RMBMS[1 ].DMA_EVENT,

MI_RMBMS[2].DMA_EVENT,

MI_RMBSM[3].DMA_EVENT, MI_RMBSM[0].ENABLE_EVENT,

MI_RMBMS[1].ENABLE_EVENT, MI_RMBMS[2].ENABLE_EVENT, MI_RMBMS[3].ENABLE_EVENT, MI_RMBMS[0].DISENABLE_EVENT, MI_RMBMS[1 l.DISENABLE_EVENT,

MI_RMBMS[2].DISENABLE_EVENT, MI_RMBMS[3].DISENABLE_EVENT, MI_RM_AUX.TIME_CHANGE, and waιt_result

RMBMS_ιdx = (wait_result - 1 ) MOD 4 case idx = wait result DIV 4

CASE [case_idx]

[0] Call DMA_Completιon [1 ] Call DMA_Enable

[2] Call DM A_Di sable

[3] Call Time Change

ENDCASE REPEAT for i = 0 to 3 still waiting = MI-RMBMS(i).RMB_STS_V_EXPECTED is set and RMB STS V RECEIVED is clear

UNTIL (still waiting or final iteration)

IF ^*still_waιtιng THEN

We have a complete set of buffers;

Check MOD TASK values for valid combination

CALL update_pointer (MIF_NORMAL) waiting for first DMA = true

ENDIF

UNTIL MIF shutdown required EXIT

SUBROUTINE DMA_Completion

CALL KER$CLEAR_EVENT MI_RMBMS[RMBMS_idx].DMA_EVENT MI_RM_AUX.WD_FLAG = 1

current time = Current system time IF waiting for first DMA first dma time = current time waiting for first DMA = false ELSE

If current_time - first_dma_time>MI Sync_TOLERANCE Log Error "Out of sync- Did not receive required DMA"

Check for excessive failures: FOR i = 0 to 3

IF MI-RMBMS[i].RMS_STS_V_EXPECTED is set and RMB_STS_V_RECEIVED is clear MI_RMBMS(i].PEND_BUFF_PTR = null Log Error ' Failed to receive DMA for [DMA type]" MI_RMBMS[i]. RMB_CONS_ERRORS = RMB_C0NS_ERRORS + 1

IF MI_RMBMS[i].RMB_CONS_ERRORS > tolerance then Log Error " No longer expecting [DMA type]- too many consecutive failures" (broadcast error message)

Clear Ml RMBMS[i].RMB STS.V EXPECTED

END IF ENDIF ENDFOR

Update pointers with available data: CALL update_pointers (MIF_NO_SYNC) first dma time = current time /* Fall through to use this buffer as the first buffer in the next set... */ ENDIF

ENDIF

If buffer type is SDSS and DSS and corresponding DSS received, then CALL update pointers' ENDIF

WITH Ml RMBMS(RMBMS idx)

If *.RMB_STS_V_RECEIVED is set

Log Error ("Out of Sync-- DMA collision") CALL update_pointers (MIF_DMA_COLL) first dma time = current time /* Fall through to use this buffer as the first in the next set... */ ENDIF

IF *.RMB_STS_V_EXPECTED is notset

Log Error (" Unexpected DMA completion") ENDIF If * RMB_STS_V_DISABLED is set

Log Error (" Received comolete for disabled strobe")

Return ENDIF

Check DMA completion status i n ADSB IF error

* CONS_ERR_COUNT = *.CONS_ERR_COUNT + 1 IF *.CONS_ERR_COU NT < 5 Then

Log Error ("DMA failure on channel") ELSE

IF *.CONS_ERR_COUNT MOD 300 = 1 Log Error ("DMA still failing") ENDIF

ENDIF ELSE

*.CONS_ERR_COUNT = 0 ENDIF

rm__buffer_ptr = *.BUFFER_PTR[*.ADSB.buffer_number - 1]

*.RECEIVED_DATE_TIME = current_time *.PEND_BUFF_PTR = rm_buffer_ptr

*.RMB_STS_V_EXPECTED = true

Sef.RMB STS V RECEIVED

IF *.RMB_STS_V_DSS_BUFF is set get mod state using rm buffer ptr offset by *.RM TASK OFFSET *.MOD__TASK = moα_state IF MBMS-IDX = MI_RM_L_DSS

MI_RM_AUX.LEFT_RM_PTR = rm_buffer_ptr Signal MI_RM_AUX.HEALTH_L_EVENT

Signal MI_RM_AUX.SYSMSG_L_EVENT ELSE

MI_RM_AUX.RIGHT_RM_PTR = rm_buffer_ptr Signal MI_RM_AUX.HEALTH_R_EVENT Signal MI_RM_AUX.SYSMSG_R_EVENT ENDIF ENDIF

ENDWITH

RETURN

END SUBROUTINE

SUBROUTINE DMA_ENABLE

Clear MI_RMBMS[RMBMS_idx].DMA_ENABLE (KERSCLEAR_EVENT) MI_RMBMS [RMBMS_idx].RMB_STS_V_DlSABLED = false MI_RMBSM [RMBMS_idx].RMB_STS_V_EXPECTED = true RETURN

END SUBROUTINE

SUBROUTINE DMA DISABLE

Clear MI_RMBMS [RMBMS_idx].DMA_DISABLE (KER$CLEAR_EVENT) MI_RMBMS [RMBMS_idx].RMB_STS_V_DISABLE = true MI_RMBMS [RMBMS_idx].RMB_STS_V_EXPECTED = false Ml RMBMS [RMBMS idx].PEND BUFF PTR = Null

RETURN END SUBROUTINE

SUBROUTINE TIME CHANGE CALL KERSCLEAR_EVENT with MI_=-m_AUX.TIME_CHANGE current time = Current system time first dma time = current time

RETURN

END SUBROUTINE

o SUBROUTINE upoate_poιnters (state)

Lock MI_RM_GLOBALS mutex

MI_RM_DATA.RM_STATUS -= state 5

Copy the LEFT/SIDE SDSS/DSS pointers: MI_RM_DATA.LEFT_SDSS_PTR =

MI_RMBMS (MI_SDSS_L_IDX).PEND_BUFF_PTR MI_RM_DATA.RIGHT_SDSS_PTR = 0 MI_RMBMS (MI_SDSS_R_IDX).PEND_BUFF_PTR

MI_RM_DATA.LEFT_DSS_PTR =

MI_RMBMS (MI_DSS_L_IDX).PEND_BUFF_PTR MI_RM_DATA.RIGHT_DSS_PTR =

MI-RMBMS (MI_DSS_R_IDX).PEND_BUFF_PTR 5

Clear FOX/DOG pointers:

MI_RM_DATA.FOX_DSS_PTR = null

MI_RM_DATA.DOG_DSS_PTR = null

MI_RM_DATA.FOX_MAP_PTR = null 0 MI_RM_DATA.DOG_MAP_PTR = null

Mark the info byte as "not prime" until proven otherwise: Clear MI_RM_DATA.RIGHT_JNFO-BYTE prime bit /* Bit 0 */ Clear Ml RM DATA.LEFT INFO-BYTE prime bit 5

Set Fox side and dog side to " unknown" (1 ): MI_RM_DATA.FOX_SIDE = -1 MI_RM_DATA.DOG_SIDE = -1 Determine new FOX/DOG information :

I F MI_RMBMS (MI-DSS-L-IDX). OD_STATUS = fox status or eagle status

MI_RM_DATA. FOX_DSS_PTR =

MI_RMBMS (MI_DSS_L_IDX).PEND_BUFF_PTR MI_RM_DATA.FOX_MAP_PTR = Addr (M EMORY_MAP_L_TABLE) Set MI_RM_DATA.FOX_INFO_BYTE left/right bit /* bit 0 7 Set MI_RM_DATA.LEFT_I NFO_BYTE prime bit /* bit 2 */

MI_RM_DATA.FOX_SIDE = 0 /* Left */ IF MI RMBMS (Ml DSS. R IDX). MOD STATUS = dog status or "task B"

MI_RM_DATA.DOG_DSS_PTR =

MI_RMBMS (MI_DSS_R_IDX). PEND_BUFF_PTR MI_RM_DATA.DOG_MAP_PTR = Addr (MEMORY_MAP_L_TABLE)

Clear MI_RM_DATA.DOG_I FO_BYTE left/right bit MI_RM_DATA.DOG_SIDE = 1 /* Right 7 ENDIF

ELSE IF MI RMBMS (Ml DSS R IDX). MOD STATUS = fox status or eagle status

MI_RM_DATA.FOX_DSS_PTR =

MI_RMBMS (MI_DSS_R_IDX).PEND_BU FF_PTR MI_RM_DATA.FOX_MAP_PTR = Addr (MEMORY_MAP_R_TABLE)

Clear MI_RM_DATA.FOX_INFO_BYTE left/right bit Set MI_RM_DATA.RIGHT_INFO_BYTE prime bit MI_RM_DATA.FOX_SIDE = 1 /* Right 7

IF RMBMS (MI_DSS_L_IDX).MOD_STATUS = dog_status or "task B"

MI_RM_DATA.DOG_DSS_PTR =

MI_RMBMS (MI_DSS_L_IDX).PEND_BU FF_PTR MI_RM_DATA.DOG_MAP_PTR = Addr (MEMORY_MAP_L_TABLE) Set MI_RM_DATA. DOG_INFO-BYTE left/right bit

MI_RM_DATA.DOG_SIDE = 0 /* Left 7

ENDIF ENDIF

ENDIF

Release Ml RM GLOBALS mutex

Clear context:

FOR i = 0 to 3

MI_RMBMS (i).PEND_BUFF-PTR = null

Clear Ml RMBMS (i).RMB STS V RECEIVED

ENDFOR

END SUBROUTINE END PROGRAM

Referring to Figure 9, a diagrammatic illustration is shown of the relationship between the reflective memory buffers 314 in the front end computer 18a, the transfer map 37 in the IFS circuit 28 and the dual-ported data memory 22 in the process control computers 12a- 12b. For purposes of illustration, the data memory 22 is shown to include only two segments. The transfer map 37 indicates that data memory addresses 2000 to 2002 (hex) in the first segment, and data memory addresses 4100 to 4105 (hex)in the second segment are to be transferred to the reflective memory buffer 46a. More specifically, it should be observed that the transfer map 37 creates a block of contiguous data elements from memory Iocations in the data memory 22 which are not necessaπiy contiguous.

Referring to Figure 10, a block diagram of the IFS circuit 28 is shown. In this block diagram, the individual transmitters and receivers (for example, transmitter 38a and receiver 40a) are shown in a single block 400 which also includes the AT&T ODL200 series light converters. The IFS circuit 28 also includes control blocks 402-404 which govern the transfer of data/address signals to and from the transmitter/receiver block 400. In this regard, the IFS circuit 28 includes both an address buffer 406 and a data buffer 408 to facilitate these signal transfers. An address latch 410 is also provided for sending a data memory address to the stealth port Similarly, a transceiver 412 is provided to enable the IFS circuit 28 to send or ^receιve data information via the oata bus of the steaitn interface circuit 16

The IFS circuit 28 also includes a stealth timing and control circuit 414 The stealth timing and control circuit 414 includes one or more Programmable Array Logic circuits to implement a state macnine for processing specific signals to or from the stealth interface circuit 16 For example, when the SDSS signal is received, it provides an indication to the the IFS circuit 28 that a valid window exists for reading from the data memory 22 Assuming that the arbitration circuit on the stealth interface ci rcuit 16 also grants access to the data memory 22, then the stealth timing and control circuit 414 will appropriately set the control status register 416 The data out control circuit 404 will respond by causing a DMA counter circuit 418 to start counting down to zero from a pre-set value. The DMA counter 418 will decrement with each data word read from the data memory 22 The DMA counter 418 in turn controls a DMA word count circuit 420 which generates an address in the transfer map 37 In other words, the DMA word count circuit 420 points to an address in the transfer map 37, which in turn points to an address in the data memory 22 Through this form of indirection, the IFS circuit 28 will read each of the locations of the data memory 22 that are specified in the transfer map 37 for the particular window permitted by the process control computer 12 through the stealth interface circuit 16.

Referring to Figure 1 1 , a block diagram of the IFQ circuit 30 is shown The IFQ circuit 30 includes the Intel 80186 microprocessor, as discussed above, and the program for this microprocessor is stored in EPROM 420. Additionally, an address latch 422 is coupled to the address bus 424 of the microprocessor 42 Similarly, a data buffer 426 is connected to the data bus 428 of the microprocessor 42 A 64Kb RAM circuit 430 is also coupled to both the address bus 424 and the data bus 428 The RAM circuit 430 is used to store system data, such as one or more stacks and other operational data structures for the microprocessor 42

The IFQ circuit 30 also includes a fiber interface "daughter" board 432, which contains the circuits directly responsible for transmitting and receiving signals over the fiber optic cables 32 In this regard, block 434 includes the two channels of light converters and receiver circuits, and block 436 includes the two channels of light converters and transmitter/receiver circuits, as discussed above. With the Gazelle serial transmitter/receiver pairs, each of the fiber optic links to the IFS circuits 28a-28b is capable of transmitting 2.5 million, 40 bit frames per second. Block 44 represents the two 128Kb data buffers used for initially storing SDSS and DSS data which is asynchronously received from the process control computers 12a-12b, as discussed in connection with Figure 1 These "link" data buffers are preferably implemented using two independent memories in a dual-port configuration, one for each fiber optic channel, in order to provide real-time uninterrupted gathering of process data and messages from the IFS circuits The block 438 represents the provision of at least one word register (for each fiber ODtic cnannei) used to hold serial data to be transmitted to one of the process control computers 12a-12b

The block 440 represent the logic circuits for controlling the storing of information into tne oata buffers 44 and tne word register 438 Tne logic circuits 440 includes one or more Programmable Array Logic ("PAL") circuits for imDlementmg a state machine for handling these data write operations For example, wnen a forty bit data frame is received from one of the process control computers 12a- 12b, the logic circuits 440 will decode the address and control bit in order to steer the data bits to the appropriate memory location in the data buffers 44 The fiber interface daughter board 432 also includes an interrupt circuit block 442 which contains the interrupt logic for helping the microprocessor 42 understand the state of the data write activities In this regard, at least two separate interrupt lines are used to interconnect the interrupt circuit block 442 with the microprocessor 42 (one per fiber optic channel). Both the IFS circuit 28 and the fiber interface daughter board 432 of the IFQ circuit 30 also include a PAL state machine which examines incoming frames for errors (for example, parity errors and 4B/5B link errors). In one embodiment of the front end communication system 10, all of the state machines on the IFQ circuit 30 operate from a 20MHz clock signal which is derived from the 10M Hz clock signal of the microprocessor 42.

The microprocessor 42 is programmed to provide at least two DMA engines for moving data For example, the microprocessor 42 will respond to appropriate interrupt signals from the interrupt circuit block 442 by moving data from the data buffers 44 to a dual-ported 64Kb RAM circuit 444, which acts to provide a bucket brigade storage medium. Then, once sufficient data is stored in the dual-ported RAM circuit 444 (for example, 8Kb), the DMA state machine in the first in, first out ("FIFO") DMA control block 446 will move this data over the Q-bus 302 of the front end computer 18. Memory cycles are oreferably interleaved between both the microprocessor 42 system bus and the Q-bus, with the system bus of the microprocessor 42 given top priority. A status register circuit 448 and a CSR circuit 450 are provided to transfer status and control information. Additionally, as shown in Figure 1 1, an address buffer 452 and a DMA/FIFO counter 454 are also coupled to the address lines of the dual-ported RAM circuit 444. Similarly, a DMA/FIFO data buffer 456 for the Q-bus 302 and a data buffer for the microprocessor 42 are also coupled to the data lines of the dual-ported RAM circuit 444.

The present invention has been described in an illustrative manner. In this regard, it is evident that those skilled in the art once given the benefit of the foregoing disclosure, may now make modifications to the specific embodiments described herein without departing from the spirit of the present invention. Such modifications are to be considered within the scope of the present invention which is limited solely by the scope and spirit of the appended claims.

Claims

WHAT IS CLAIMED IS

1 A method of providing secure communications between a Diuralitv of computers on a network, comprising tne steps ot establishing a time limited communication contract between first and second computers on said network which will enable a designated type of signal communication between said first and second comDuters for a predetermined time period, said time limited communication contract being established on the basis of an acceptable response to the transmission of an unpredictable signal from one of said computers, and re-establishing said time limited communication contract between said first and second computers before said predetermined time period expires, said time limited communication contract being re-established on the basis of an acceptable response to the transmission of an new unpredictable signal from one of said computers

2 The method according to Claim 1 , wherein said step of establishing a time limited communication contract includes the steps of generating an unpredictable signal at said first computer, transmitting said unpredictable signal to said second computer, generating a predicable modification to said unpredictable signal at said second computer, transmitting said modified unpredictable signal to said first computer, and determining at said first computer whether said modified unpredictable signal is acceptable before permitting said designated type of signal communication between said first and second computers

3. The method according to Claim 2, wherein said modified unpredictable signal is determined to be acceptable if it matches an expected modification of said unpredictable ^sι9^πal

4 The method according to Claim 3, wherein said unpredictable signal is a pseudo¬ random number

5 The method according to Claim 4, wherein said predicable modification of said unpredictable signal is an encrypted form of said pseudo- random number

6 The method according to Claim 2, wherein said pseudo-random number has a digital length of at least 32 bits

7 The method according to Claim 2, wherein said designated type of signal communication includes an instruction from said second comouter to said first computer which commands a modification of at least one process control variable 8. The method according to Claim 5, wherein said pseudo-random number is encrypted by said second computer in accordance with an algorithm which is uniαue to the compiled version of an apDlication program running in said first computer.

9. The method according to Claim 8, wherein said time limited communication contract is re-established at intervals of less than one minute.

10. The method according to Claim 9, wherein said predetermined time period is less than one minute.

1 1. The method according to Claim 10, wherein said predetermined time period is less than 30 seconds.

12. A secure front end communication system for at least one process control computer which controls the operation of a physical process, including a computer network for enabling communication between a plurality of computers, and at least one computer entity conneαed to said computer network, characterized in that: at least one front end computer connected between said process control computer and said computer network, said front end computer having means for establishing a time limited communication contract with said computer entity on the basis of an acceptable response to the transmission of an unpredictable signal rom said front end computer to said computer entity, said time limited communication contract enabling a designated type of signal communication from said computer entity to said process control computer.

13. The secure front end communication system according to Claim 12, wherein said computer entity includes means for generating an expeαed modification of said unprediαable signal, and said establishing means in said front end computer includes means for determining whether the modified unpredictable signal received from said computer entity is acceptable.

14. The secure front end communication system according to Claim 13, wherein said establishing means determines that said modified unpredictable signal is acceptable if it matches an expected modification of said unpredictable signal.

15. The secure front end communication system according to Claim 14, wherein said unpredictable signal is a pseudo-random number. 16. The secure front enα communication system according to Claim 15, wherein said exoected modification of said unpredictable signal is an encrypted form of said pseudo- ^random number.

17 The secure front end communication system according to Claim 13, wnerein said pseudo-random number has a digital length of at least 32 bits.

18. The method according to Claim 16, wherein said computer entity encrypts said pseuoo-random number in accordance with an algorithm which is unique to the compiled version of an application program running in said process control computer.

19. The secure front end communication system according to Claim 18, wherein said time limited communication contract is re-established at intervals of less than one minute.

20. The secure front end communication system according to Claim 19, wherein said predetermined time period is less than one minute.

21. The secure front end communication system according to Claim 20, wherein said predetermined time period is less than 30 seconds.

22. The secure front end communication system according to Claim 13, wherein said designated type of signal communication includes an instruction from said computer entity to said process control computer that commands a modification of at least one process control variable.

23. The secure front end communication system according to Claim 22, wherein said front end computer includes means for storing at least one permissive table, and means for determining whether such an instruction from said computer entity will be transmitted by said front end computer to said process control computer from a comparison of the process control variable sought to be modified and an enable indicator contained in said permissive table for said process control variable.

24. The secure front end communication system according to Claim 12, further including a security server connected to said computer network, said security server having means for storing a security table which identifies the comouter entities on said computer network that are permitted to send commands to said process control computer, and means for responding to a network message from said front end computer which requests a copy of said security table by transmitting a responsive network message which includes an encrypted transformation of an unpredictable component contained in said reαuestmg network message from said front end computer

25 Tne secure front end communication system according to Claim 22, wnerein said computer network includes a plurality of network segments, and means for preventing the transmission of a network message that includes such a variable modification instruction to the network segment on which said front end computer resides from at least one other network segment of said computer network 26 A secure front end communication system for at least one process control computer which controls the operation of a physical process, comprising: a computer network for enabling communication between a plurality of computers; at least one computer entity connected to said computer network; and at least one front end computer connected between said process control computer and said computer network, said front end computer having means for storing at least one permissive table, and means τor determining whether a predetermined type of instruction from said computer entity will be transmitted to said process control computer by checking the status of an enable indicator in said permissive table for the variable which corresponds to said variable from said instruction

27 The secure front end communication system according to Claim 26, including at least two actively redundant process control computers, and said front end computer is connected to each of said actively redundant process control computers.

28. The secure front end communication system according to Claim 27, wherein said front end computer includes a distinct permissive table for each of said actively redundant process control computers

29. The secure front end communication system according to Claim 28, wherein at least one of said permissive tables is associated with a compiled version of the operating program of one of said actively redundant process control computers which is different than the compiled version of the operating program of one of the other of said actively redundant process control computers.

30. A method of controlling the communication of a command message from a computer entity on a computer network to a process control computer which seeks to change at least one of a plurality of operating variables employed by saiα process control computerto control a physical process, comprising the steps of: providing a front end computer which is connected between said process control computer and said computer network; storing a oermissive table in said front end comouter that identifies wnich of said operating variables may oe changed by said computer entity; receiving a commanα message from said computer entity; determining if said commanα message incluαes an instruction which seeks to change at least one operating variable in said process control computer; ana determining whether to transmit said command message from said front end computer to said process control computer by checking the status of an enaole indicator in said permissive table which is associated with the corresponding operating variable identified in said command message.

31. The method according to Claim 30, including the step of transmitting a program version identifier from said front end computer to said process control computer when it is determined to enable the transmission of said command message to said process control computer.

32. The method according to Claim 31 , including the step of determining at said process control computer whether to implement the command message received from said front end computer on the basis of whether the transmitted program version identifier matches a program version identifier stored in said process control computer. 33. Them method according to Claim 32, including the step of encrypting said program version identifier at said front end computer before its transmission to said process control computer.